#!/usr/bin/env php yIntegrity/Inspector.php  h(Integrity/Manifest.php%%'tѤDetection/Deobfuscator.phpvvٙmDetection/PhpCodeContext.php@ @ %ʷDetection/Exploits.phprDetection/CodeMatch.phpHHjDetection/Functions.phpEEƤDetection/Signatures.php)){3!Detection/ArithmeticEvaluator.php/CߤFindings/Finding.php@F%tFindings/FindingStore.php""QlPlatform/RepositoryVerifier.php**7] Platform/ComponentReport.phpS S be!Platform/WooCommerce/Verifier.php]QPlatform/PlatformRegistry.php4B'Platform/CakePHP/ProcessApiProvider.phpYPlatform/CakePHP/Verifier.phpX  Platform/WordPress/Inventory.phpe e p4(Platform/WordPress/DatabaseScanPhase.php77U)Platform/WordPress/ProcessApiProvider.php$?'Platform/WordPress/ContentInventory.php[z%Platform/WordPress/DatabaseReport.phpa%%Platform/WordPress/UpdateProvider.php+ + 衻mPlatform/WordPress/Database.php̤Platform/WordPress/Verifier.phpKYKY0Platform/ScanPhaseInterface.php~Cg+Platform/CodeIgniter/ProcessApiProvider.php)/!Platform/CodeIgniter/Verifier.php55s"&Platform/Drupal/ProcessApiProvider.php, , +Platform/Drupal/Verifier.phptxƤ,Platform/ComposerPackageVerifierAbstract.php[j'Platform/Symfony/ProcessApiProvider.php*gPlatform/Symfony/Verifier.phpooˤPlatform/Composer/Inventory.php땩Platform/Composer/Verifier.php6r6r{Platform/VerifierInterface.php22 (Platform/ProcessApiProviderInterface.phpfվPlatform/ProcessDetector.phpRS'Platform/Magento/ProcessApiProvider.phpT[Platform/Magento/Verifier.php} } ֦#Platform/ProcessCommandAnalyzer.php;;Dz'Platform/ProcessApiProviderAbstract.php;#Platform/Yii/ProcessApiProvider.phpGVPlatform/Yii/Verifier.phpDf*Platform/PrestaShop/ProcessApiProvider.php- P Platform/PrestaShop/Verifier.php'Platform/Laravel/ProcessApiProvider.php Platform/Laravel/Verifier.phpn&Platform/Joomla/ProcessApiProvider.phpytPlatform/Joomla/Verifier.phpc c 6Platform/Platform.php0_&%Platform/TYPO3/ProcessApiProvider.phpvrPlatform/TYPO3/Verifier.php  DReputation/DomainExtractor.php^^ l`&Reputation/MaltrailDefinitionStore.phpB/B/RVReputation/DomainScanner.php / .Remote/FtpClientInterface.php JL?Remote/NativeFtpClient.php"Remote/FtpMirror.php##>å%Definitions/DefinitionBundleStore.phpLLS.O'Definitions/DefinitionArchiveReader.phpP(Definitions/DefinitionArchiveBuilder.phptؤDefinitions/RuleData.phpLL\%Definitions/LocalDefinitionSource.php##EScan/SourceSizeAnalyzer.php  sScan/ArchiveScanner.phpX)X)/ͤScan/Whitelist.php11ZScan/CheckpointStore.php>?Scan/Scanner.php~F~F©nAI/FindingReviewer.php`5`5Zl AI/Providers/ProviderFactory.phpMM1AI/Providers/Http/Anthropic/AnthropicProvider.php ga +AI/Providers/Http/OpenAI/OpenAIProvider.php{ { $#*AI/Providers/Http/AbstractHttpProvider.phpzzFV&+AI/Providers/Http/Gemini/GeminiProvider.php wM.AI/Providers/WordPress/WordPressAIProvider.php +bФ"AI/Providers/ProviderInterface.php--y6+AI/Providers/Cli/Codex/CodexCliProvider.php>>7/AI/Providers/Cli/Copilot/CopilotCliProvider.phpJ(AI/Providers/Cli/AbstractCliProvider.phpb5AI/Providers/Cli/ClaudeCode/ClaudeCodeCliProvider.phpn1AI/Providers/Cli/OpenCode/OpenCodeCliProvider.phpͤ,AI/Exceptions/RetryableProviderException.phphh&)AI/Exceptions/AuthenticationException.phpeeOXe#AI/Exceptions/ProviderException.php__7%AI/Exceptions/IncompleteException.phpaa"AI/Exceptions/BlockedException.php^^2AI/Exceptions/InvalidStructuredOutputException.phpnn'sa$AI/Exceptions/TransportException.phpiiF$AI/Exceptions/RateLimitException.phpii|AI/ReviewRequest.phpDDH9 AI/ReviewResult.php 8^Console/CLI.php.H.H ُConsole/Figlet.php77mYConsole/Argument.phpɓConsole/Argv.php''|W>!Console/DefinitionApplication.phpA,Console/Application.phph Console/Flag.phpDDƽAFilesystem/Path.php:ˊdFilesystem/Cache.phpK"K"y^Filesystem/AtomicFile.php $Filesystem/ResourceLocator.php55}1xReporting/Report.php Reporting/Table.phpo o "Remediation/FileRemediator.php5Remediation/Diff.phppRemediation/Editor.phpIIЈRemediation/PhpLinter.php=Remediation/Actions.phpff\!resources/console/fonts/rozzo.flf $resources/console/fonts/colossal.flf55&resources/console/fonts/smkeyboard.flf ]xL!resources/console/fonts/basic.flf* resources/console/fonts/stop.flf%&resources/console/fonts/ansishadow.flf..ΦѤresources/templates/Report.html  :5 'resources/definitions/definitions.amwdb::Sbootstrap/legacy_aliases.php bootstrap/autoload.phpaaʗ[ bin/amwscann * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Integrity; use AMWScan\Findings\Finding; class Inspector { public function inspect(Manifest $manifest, $provider = 'trusted-manifest') { $findings = []; $expected = $manifest->getFiles(); $expectedKeys = []; foreach (array_keys($expected) as $relativePath) { $expectedKeys[$this->pathKey($relativePath)] = true; } foreach ($expected as $relativePath => $entry) { $path = $manifest->path($relativePath); if (!is_file($path) || is_link($path)) { $findings[] = $this->finding($manifest, $relativePath, 'missing', 'warn', 'A managed file is missing.', [ 'expected_hash' => $entry['hash'], 'algorithm' => $entry['algorithm'], ], $provider); continue; } $currentHash = hash_file($entry['algorithm'], $path); if (!is_string($currentHash) || !$this->matches($entry['hashes'], strtolower($currentHash))) { $findings[] = $this->finding($manifest, $relativePath, 'modified', 'danger', 'A managed file differs from its trusted manifest.', [ 'expected_hashes' => $entry['hashes'], 'current_hash' => is_string($currentHash) ? strtolower($currentHash) : null, 'algorithm' => $entry['algorithm'], ], $provider); } } foreach ($manifest->getManagedRoots() as $managedRoot) { $directory = $manifest->path($managedRoot); if (!is_dir($directory) || is_link($directory)) { continue; } $iterator = new \RecursiveIteratorIterator( new \RecursiveDirectoryIterator($directory, \FilesystemIterator::SKIP_DOTS) ); foreach ($iterator as $item) { if (!$item->isFile() && !$item->isLink()) { continue; } $path = $item->getPathname(); $relativePath = str_replace('\\', '/', substr($path, strlen($manifest->getRoot()) + 1)); if (!isset($expectedKeys[$this->pathKey($relativePath)])) { if ($item->isLink()) { $linkTarget = readlink($path); $currentHash = is_string($linkTarget) ? hash('sha256', 'symlink:' . str_replace('\\', '/', $linkTarget)) : null; } else { $hash = hash_file('sha256', $path); $currentHash = is_string($hash) ? strtolower($hash) : null; } $findings[] = $this->finding($manifest, $relativePath, 'extra', 'warn', 'An unexpected file exists in a managed directory.', [ 'algorithm' => 'sha256', 'current_hash' => $currentHash, 'content_hash' => $currentHash, ], $provider); } } } return $findings; } private function pathKey($relativePath) { $relativePath = str_replace('\\', '/', $relativePath); return DIRECTORY_SEPARATOR === '\\' ? strtolower($relativePath) : $relativePath; } private function matches(array $expectedHashes, $currentHash) { foreach ($expectedHashes as $expectedHash) { if (hash_equals($expectedHash, $currentHash)) { return true; } } return false; } private function finding(Manifest $manifest, $relativePath, $status, $severity, $message, array $evidence = [], $provider = 'trusted-manifest') { $evidence['manifest_version'] = $manifest->getVersion(); $evidence['relative_path'] = $relativePath; return Finding::create( 'integrity', $manifest->path($relativePath), 'integrity:' . $status, $severity, $message, $evidence, $provider ); } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Integrity; class Manifest { private $files; private $managedRoots; private $root; private $version; public function __construct($root, $version, array $files, array $managedRoots = []) { $resolvedRoot = realpath($root); if ($resolvedRoot === false || !is_dir($resolvedRoot)) { throw new \InvalidArgumentException('Integrity manifest root must be an existing directory.'); } if (!is_string($version) || trim($version) === '') { throw new \InvalidArgumentException('Integrity manifest version must be a non-empty string.'); } $validatedFiles = []; foreach ($files as $path => $entry) { $path = self::validateRelativePath($path); if (!is_array($entry)) { throw new \InvalidArgumentException(sprintf('Integrity entry "%s" must be an array.', $path)); } $algorithm = isset($entry['algorithm']) ? strtolower((string)$entry['algorithm']) : ''; $hashes = isset($entry['hashes']) && is_array($entry['hashes']) ? $entry['hashes'] : [isset($entry['hash']) ? $entry['hash'] : '']; $hashes = array_values(array_unique(array_map('strtolower', $hashes))); if (!in_array($algorithm, hash_algos(), true) || empty($hashes) || array_filter($hashes, static function ($hash) { return !is_string($hash) || !preg_match('/^[a-f0-9]+$/', $hash); })) { throw new \InvalidArgumentException(sprintf('Integrity entry "%s" has an invalid checksum.', $path)); } $entry['algorithm'] = $algorithm; $entry['hash'] = $hashes[0]; $entry['hashes'] = $hashes; $validatedFiles[$path] = $entry; } ksort($validatedFiles); $validatedRoots = []; foreach ($managedRoots as $managedRoot) { $validatedRoots[] = self::validateRelativePath($managedRoot); } $this->root = rtrim($resolvedRoot, '/\\'); $this->version = trim($version); $this->files = $validatedFiles; $this->managedRoots = array_values(array_unique($validatedRoots)); } public function getRoot() { return $this->root; } public function getVersion() { return $this->version; } public function getFiles() { return $this->files; } public function getManagedRoots() { return $this->managedRoots; } public function path($relativePath) { $relativePath = self::validateRelativePath($relativePath); return $this->root . DIRECTORY_SEPARATOR . str_replace('/', DIRECTORY_SEPARATOR, $relativePath); } public static function validateRelativePath($path) { if (!is_string($path) || $path === '' || strpos($path, "\0") !== false) { throw new \InvalidArgumentException('Manifest paths must be non-empty strings.'); } $path = str_replace('\\', '/', trim($path)); if ($path === '' || $path[0] === '/' || preg_match('/^[a-z]:\//i', $path)) { throw new \InvalidArgumentException(sprintf('Manifest path "%s" must be relative.', $path)); } $segments = explode('/', $path); foreach ($segments as $segment) { if ($segment === '' || $segment === '.' || $segment === '..') { throw new \InvalidArgumentException(sprintf('Manifest path "%s" is unsafe.', $path)); } } return implode('/', $segments); } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Detection; /** * Class Deobfuscator. */ class Deobfuscator { private const MAX_DECODE_PASSES = 12; private const MAX_DECODED_BYTES = 8388608; /** * Deobfuscate code. * * @return bool|mixed|string|string[]|null */ public function deobfuscate($str) { $str = str_replace([".''", "''.", '.""', '"".'], '', $str); $type = $this->getObfuscateType($str); if (empty($type)) { $strDecoded = $this->decode($str); $type = $this->getObfuscateType($strDecoded); if (!empty($type)) { $str = $strDecoded; } } if (in_array('globals', $type, true)) { $str = $this->deobfuscateBitrix($str); } if (in_array('eval', $type, true)) { $str = $this->deobfuscateEval($str); } if (in_array('als', $type, true)) { $str = $this->deobfuscateAls($str); } if (in_array('lockit', $type, true)) { $str = $this->deobfuscateLockit($str); } if (in_array('fopo', $type, true)) { $str = $this->deobfuscateFopo($str); } if (in_array('byterun', $type, true)) { $str = $this->deobfuscateByterun($str); } if (in_array('urldecode_globals', $type, true)) { $str = $this->deobfuscateUrldecode($str); } return $str; } /** * Decode. */ public function decode($code) { $matchesPhp = CodeMatch::getCode($code); $remainingOutputBytes = self::MAX_DECODED_BYTES; $remainingDecodeWorkBytes = self::MAX_DECODED_BYTES; foreach ($matchesPhp as $matchPhp) { $str = preg_replace("/(<\?(php)?)(.*?)(?!\B\"[^\"]*)(\?>|$)(?![^\"]*\"\B)/si", '$1$3$4', @$matchPhp[0]); $str = $this->decodeEscapedStringLiterals($str); // Convert chr $str = preg_replace_callback('~\\\\?(chr|mb_chr)\s*\(\s*(?:codepoint\s*:\s*)?([0-9a-fxX\s\(\)\.\*\/%+\-]{1,4096})\s*\)~i', function ($match) { $value = trim($this->calc(trim($match[2]))); $function = strtolower($match[1]); if (!is_numeric($value) || !function_exists($function)) { return $match[0]; } $codepoint = (int)$value; if ($function === 'chr') { $codepoint = (($codepoint % 256) + 256) % 256; } try { $result = call_user_func($function, $codepoint); } catch (\Throwable $exception) { return $match[0]; } if (!is_string($result)) { return $match[0]; } return $this->quotePhpString($result); }, $str); // Remove point between two strings ex. "ev"."al" to "eval" $str = preg_replace("/(\\'|\\\")[\s\r\n]*\.[\s\r\n]*('|\")/", '', $str); $str = $this->normalizeWhitespace($str); // Decode strings $decoders = [ 'str_rot13', 'gzinflate', 'base64_decode', 'rawurldecode', 'gzuncompress', 'gzdecode', 'strrev', 'convert_uudecode', 'urldecode', 'hex2bin', ]; $patternDecoder = []; foreach ($decoders as $decoder) { $patternDecoder[] = preg_quote($decoder, '/'); } $stringPattern = '("(?:\\\\.|[^"\\\\])*"|\'(?:\\\\.|[^\'\\\\])*\')'; $regexPattern = '~(^|[^a-zA-Z0-9_\\\\$>:])\\\\?(' . implode('|', $patternDecoder) . ')[\s\r\n]*\([\s\r\n]*(?:[a-zA-Z_][a-zA-Z0-9_]*[\s\r\n]*:[\s\r\n]*)?' . $stringPattern . '[\s\r\n]*(?:,[\s\r\n]*(?:[a-zA-Z_][a-zA-Z0-9_]*[\s\r\n]*:[\s\r\n]*)?(true|false))?[\s\r\n]*\)~i'; for ($pass = 0; $pass < self::MAX_DECODE_PASSES; $pass++) { $decoded = preg_replace_callback($regexPattern, function ($match) use (&$remainingOutputBytes, &$remainingDecodeWorkBytes) { $value = $this->decodePhpStringLiteral($match[3]); if ($value === null) { return $match[0]; } $strict = (isset($match[4]) && $match[4] !== '') ? strtolower($match[4]) === 'true' : null; $isCompressed = in_array(strtolower($match[2]), ['gzinflate', 'gzuncompress', 'gzdecode'], true); $maximumResultBytes = min( self::MAX_DECODED_BYTES, $remainingOutputBytes + strlen($match[0]), $isCompressed ? $remainingDecodeWorkBytes : self::MAX_DECODED_BYTES ); if ($maximumResultBytes === 0) { return $match[0]; } $result = $this->applyDecoder($match[2], $value, $strict, $maximumResultBytes); if ($isCompressed) { $workBytes = ($result === null) ? $maximumResultBytes : strlen($result); $remainingDecodeWorkBytes = max(0, $remainingDecodeWorkBytes - $workBytes); } if ($result === null) { return $match[0]; } $replacement = $match[1] . $this->quotePhpString($result); $growth = strlen($replacement) - strlen($match[0]); if ($growth > $remainingOutputBytes) { return $match[0]; } if ($growth > 0) { $remainingOutputBytes -= $growth; } return $replacement; }, $str); if (!is_string($decoded) || $decoded === $str) { break; } $str = $decoded; } $code = str_replace($matchPhp[0], $str, $code); } return $code; } private function normalizeWhitespace($code) { if (strpos($code, '<<<') === false) { return preg_replace('/\s+/', ' ', $code); } $result = ''; $outside = ''; $heredocDepth = 0; foreach (token_get_all($code) as $token) { $id = is_array($token) ? $token[0] : null; $text = is_array($token) ? $token[1] : $token; if ($id === T_START_HEREDOC) { $result .= preg_replace('/\s+/', ' ', $outside); $outside = ''; $heredocDepth++; } // Preserve literal bodies and the line breaks required by their delimiters. if ($heredocDepth > 0) { $result .= $text; } else { $outside .= $text; } if ($id === T_END_HEREDOC) { $heredocDepth--; } } return $result . preg_replace('/\s+/', ' ', $outside); } /** * Decode a constant PHP string literal. * * @return string|null */ private function decodePhpStringLiteral($literal) { if (!is_string($literal) || strlen($literal) < 2) { return null; } $quote = $literal[0]; $value = substr($literal, 1, -1); if ($quote === "'") { return str_replace(['\\\\', "\\'"], ['\\', "'"], $value); } if ($quote !== '"' || preg_match('/(^|[^\\\\])(?:\\\\\\\\)*\$(?:[a-zA-Z_\x80-\xff]|\{)/', $value)) { return null; } return $this->decodePhpDoubleQuotedString($value); } /** * Decode PHP double-quoted escapes without applying C-only escapes. * * @return string|null */ private function decodePhpDoubleQuotedString($value) { $result = ''; $length = strlen($value); $escapeMap = [ 'n' => "\n", 'r' => "\r", 't' => "\t", 'v' => "\v", 'e' => chr(27), 'f' => "\f", '\\' => '\\', '$' => '$', '"' => '"', ]; for ($index = 0; $index < $length; $index++) { if ($value[$index] !== '\\') { $result .= $value[$index]; continue; } if (!isset($value[$index + 1])) { return null; } $escape = $value[$index + 1]; if (array_key_exists($escape, $escapeMap)) { $result .= $escapeMap[$escape]; $index++; continue; } if ($escape === 'x') { $digits = ''; $position = $index + 2; while ($position < $length && strlen($digits) < 2 && strpos('0123456789abcdefABCDEF', $value[$position]) !== false) { $digits .= $value[$position++]; } if ($digits !== '') { $result .= chr(hexdec($digits)); $index = $position - 1; continue; } } if ($escape === 'u' && isset($value[$index + 2]) && $value[$index + 2] === '{') { $end = strpos($value, '}', $index + 3); if ($end === false) { return null; } $digits = substr($value, $index + 3, $end - $index - 3); if ($digits === '' || strspn($digits, '0123456789abcdefABCDEF') !== strlen($digits)) { return null; } try { $character = mb_chr(hexdec($digits), 'UTF-8'); } catch (\Throwable $exception) { return null; } if (!is_string($character)) { return null; } $result .= $character; $index = $end; continue; } if ($escape >= '0' && $escape <= '7') { $digits = ''; $position = $index + 1; while ($position < $length && strlen($digits) < 3 && $value[$position] >= '0' && $value[$position] <= '7') { $digits .= $value[$position++]; } $result .= chr(octdec($digits) & 255); $index = $position - 1; continue; } $result .= '\\' . $escape; $index++; } return $result; } /** * Decode escapes only in constant double-quoted PHP strings. */ private function decodeEscapedStringLiterals($code) { if (!function_exists('token_get_all')) { return $code; } $result = ''; foreach (token_get_all($code) as $token) { if (!is_array($token)) { $result .= $token; continue; } $value = $token[1]; if ($token[0] === T_CONSTANT_ENCAPSED_STRING && isset($value[0]) && $value[0] === '"' && preg_match('/\\\\(?:x[0-9a-f]{1,2}|[0-7]{1,3})/i', $value) ) { $decoded = $this->decodePhpStringLiteral($value); if ($decoded !== null) { $value = $this->quotePhpString($decoded); } } $result .= $value; } return $result; } /** * Apply an allowlisted decoder with a bounded output size. * * @return string|null */ private function applyDecoder($decoder, $value, $strict = null, $maximumResultBytes = null) { $decoder = strtolower($decoder); if ($strict !== null && $decoder !== 'base64_decode') { return null; } if ($maximumResultBytes === null) { $maximumResultBytes = self::MAX_DECODED_BYTES; } $maximumResultBytes = min(self::MAX_DECODED_BYTES, max(0, (int)$maximumResultBytes)); if ($maximumResultBytes === 0) { return null; } try { switch ($decoder) { case 'base64_decode': $result = base64_decode($value, $strict === true); break; case 'gzinflate': $result = $this->withoutWarnings(function () use ($value, $maximumResultBytes) { return gzinflate($value, $maximumResultBytes); }); break; case 'gzuncompress': $result = $this->withoutWarnings(function () use ($value, $maximumResultBytes) { return gzuncompress($value, $maximumResultBytes); }); break; case 'gzdecode': $result = $this->withoutWarnings(function () use ($value, $maximumResultBytes) { return gzdecode($value, $maximumResultBytes); }); break; case 'str_rot13': $result = str_rot13($value); break; case 'strrev': $result = strrev($value); break; case 'rawurldecode': $result = rawurldecode($value); break; case 'urldecode': $result = urldecode($value); break; case 'convert_uudecode': $result = $this->withoutWarnings(function () use ($value) { return convert_uudecode($value); }); break; case 'hex2bin': $result = $this->withoutWarnings(function () use ($value) { return hex2bin($value); }); break; default: return null; } } catch (\Throwable $exception) { return null; } if (!is_string($result) || strlen($result) > $maximumResultBytes) { return null; } return $result; } /** * Invoke a decoder without leaking expected malformed-input warnings. */ private function withoutWarnings($callback) { set_error_handler(function () { return true; }); try { return call_user_func($callback); } finally { restore_error_handler(); } } private function isPlausiblePhpPayload($payload) { if (!is_string($payload) || trim($payload) === '' || strlen($payload) > self::MAX_DECODED_BYTES) { return false; } if (preg_match('/[\x00-\x08\x0B\x0C\x0E-\x1F]/', $payload)) { return false; } return preg_match( '/(?:<\?(?:php)?|\$[a-zA-Z_\x80-\xff]|\b(?:echo|eval|function|include|namespace|print|require|return)\b|[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff]*\s*\()/i', $payload ) === 1; } /** * Quote decoded bytes without changing PHP string interpolation semantics. */ private function quotePhpString($value) { return "'" . str_replace(['\\', "'"], ['\\\\', "\\'"], $value) . "'"; } /** * Deobfuscate bitrix. * * @return string|string[]|null */ private function deobfuscateBitrix($str) { $res = $str; $funclist = []; $valid = true; $res = preg_replace("|[\"']\s*\.\s*['\"]|mi", '', $res); $res = preg_replace_callback('~(?:min|max)\(\s*\d+[\,\|\s\|+\|\-\|\*\|\/][\d\s\.\,\+\-\*\/]+\)~m', function ($expr) { return $this->calc($expr); }, $res); $res = preg_replace_callback('|(round\((.+?)\))|smi', function ($matches) { return is_numeric($matches[2]) ? round($matches[2]) : $matches[0]; }, $res); $stringPattern = '("(?:\\\\.|[^"\\\\])*"|\'(?:\\\\.|[^\'\\\\])*\')'; $res = preg_replace_callback('~base64_decode\s*\(\s*' . $stringPattern . '\s*\)~i', function ($matches) { $value = $this->decodePhpStringLiteral($matches[1]); if ($value === null) { return $matches[0]; } $decoded = base64_decode($value, false); return ($decoded === false) ? $matches[0] : $this->quotePhpString($decoded); }, $res); $res = preg_replace_callback('~' . $stringPattern . '~s', function ($matches) { $value = $this->decodePhpStringLiteral($matches[1]); if ($value === null) { return $matches[0]; } $decoded = base64_decode($value, false); $normalized = preg_replace('/\s+/', '', $value); if (is_string($decoded) && base64_encode($decoded) === $normalized && preg_match('#^[ -~]*$#', $decoded) ) { return $this->quotePhpString($decoded); } return $this->quotePhpString($value); }, $res); if (preg_match_all('~\$(?:\{["\'])?GLOBALS(?:["\']\})?\[["\'](.+?)["\']\]\s*=\s*(?:Array\s*\((.*?)\)|\[(.*?)\])\s*;~smi', $res, $founds, PREG_SET_ORDER)) { foreach ($founds as $found) { $varname = $found[1]; $values = ($found[2] !== '') ? $found[2] : $found[3]; $funclist[$varname] = array_map(function ($value) { return trim(trim($value), "'\""); }, explode(',', $values)); $pattern = '~\$(?:\{["\'])?GLOBALS(?:["\']\})?\[["\']' . preg_quote($varname, '~') . '["\']\]\[(\d+)\]~smi'; $res = preg_replace_callback($pattern, function ($matches) use ($varname, $funclist, &$valid) { $index = (int)$matches[1]; if (!array_key_exists($index, $funclist[$varname])) { $valid = false; return $matches[0]; } return $funclist[$varname][$index]; }, $res); } } if (!$valid) { return $str; } if (preg_match_all('|function\s*(\w{1,60})\(\$\w+\){\$\w{1,60}\s*=\s*Array\((.{1,30000}?)\);[^}]+}|smi', $res, $founds, PREG_SET_ORDER)) { foreach ($founds as $found) { $strlist = explode(',', $found[2]); $res = preg_replace_callback('|' . preg_quote($found[1], '|') . '\((\d+)\)|smi', function ($matches) use ($strlist, &$valid) { $index = (int)$matches[1]; if (!array_key_exists($index, $strlist)) { $valid = false; return $matches[0]; } return $strlist[$index]; }, $res); } } if (!$valid) { return $str; } $res = preg_replace('~<\?(php)?\s*\?>~mi', '', $res); if (preg_match_all('~<\?\s*function\s*(_+(.{1,60}?))\(\$[_0-9]+\)\{\s*static\s*\$([_0-9]+)\s*=\s*(true|false);.{1,30000}?\$\3=array\((.*?)\);\s*return\s*base64_decode\(\$\3~smi', $res, $founds, PREG_SET_ORDER)) { foreach ($founds as $found) { $strlist = explode("',", $found[5]); $res = preg_replace_callback('|' . preg_quote($found[1], '|') . '\((\d+)\)|sm', function ($matches) use ($strlist, &$valid) { $index = (int)$matches[1]; if (!array_key_exists($index, $strlist)) { $valid = false; return $matches[0]; } return $strlist[$index] . "'"; }, $res); } } return $valid ? $res : $str; } /** * Calc. */ private function calc($expr, $level = 0) { if ($level > 100) { return $expr; } if (is_array($expr)) { $expr = $expr[0]; } if (!is_string($expr) && !is_numeric($expr)) { return $expr; } $original = (string)$expr; $expression = trim($original); if ($expression === '') { return $original; } $value = ArithmeticEvaluator::evaluate($expression); if ($value === null) { return $original; } $leadingLength = strspn($original, " \t\r\n\v\f"); $trailingLength = strspn(strrev($original), " \t\r\n\v\f"); $leading = substr($original, 0, $leadingLength); $trailing = ($trailingLength > 0) ? substr($original, -$trailingLength) : ''; return $leading . $value . $trailing; } /** * Deobfuscate eval. */ private function deobfuscateEval($str) { $res = $this->decode($str); $stringPattern = '("(?:\\\\.|[^"\\\\])*"|\'(?:\\\\.|[^\'\\\\])*\')'; $res = preg_replace_callback('~\beval\s*\(\s*' . $stringPattern . '\s*\)\s*;~i', function ($matches) { $decoded = $this->decodePhpStringLiteral($matches[1]); return ($decoded === null) ? $matches[0] : $decoded; }, $res); return $res; } /** * Get eval code. * * @return mixed|string */ private function getEvalCode($string) { preg_match("/eval\((.*?)\);/", $string, $matches); return (empty($matches)) ? '' : end($matches); } /** * Get text inside quotes. * * @return mixed|string */ private function getTextInsideQuotes($string) { if (preg_match_all('/("(.*?)")/', $string, $matches)) { $array = end($matches); return @end($array); } if (preg_match_all('/(\'(.*?)\')/', $string, $matches)) { $array = end($matches); return @end($array); } return ''; } /** * Deobfuscate lockit. * * @return string */ private function deobfuscateLockit($str) { $obfPHP = $str; $encoded = $this->getTextInsideQuotes($this->getEvalCode($obfPHP)); $phpcode = base64_decode($encoded, false); if (!is_string($phpcode) || $phpcode === '' || strlen($phpcode) > self::MAX_DECODED_BYTES) { return $str; } $hexvalues = $this->getHexValues($phpcode); $tmpPoint = $this->getHexValues($obfPHP); $needles = $this->getNeedles($phpcode); if (count($tmpPoint) < 1 || count($hexvalues) < 2 || count($needles) < 2) { return $str; } $pointer1 = hexdec($tmpPoint[0]); $pointer2 = hexdec($hexvalues[0]); $pointer3 = hexdec($hexvalues[1]); $needle = $needles[count($needles) - 2]; $beforeNeedle = end($needles); if ($pointer1 <= 0 || $pointer2 + $pointer3 >= strlen($obfPHP) || $needle === '' || $beforeNeedle === '') { return $str; } $phpcode = base64_decode(strtr(substr($obfPHP, $pointer2 + $pointer3, $pointer1), $needle, $beforeNeedle), false); if (!$this->isPlausiblePhpPayload($phpcode)) { return $str; } return ""; } /** * Get needles. * * @return array */ private function getNeedles($string) { preg_match_all("/'(.*?)'/", $string, $matches); return (empty($matches)) ? [] : $matches[1]; } /** * Get hex values. * * @return array */ private function getHexValues($string) { preg_match_all('/0x[a-fA-F0-9]{1,8}/', $string, $matches); return (empty($matches)) ? [] : $matches[0]; } /** * Deobfuscate als. * * @return string */ private function deobfuscateAls($str) { if (!preg_match('~__FILE__;\$[O0]+=[0-9a-fx]+;eval\(\$[O0]+\(\'([^\']+)\'\)\);return;~mix', $str, $layer1)) { return $str; } $decodedLayer = base64_decode($layer1[1], false); if (!is_string($decodedLayer) || !preg_match('~\$[O0]+=(\$[O0]+\()+\$[O0]+,[0-9a-fx]+\),\'([^\']+)\',\'([^\']+)\'\)\);eval\(~mix', $decodedLayer, $layer2) ) { return $str; } $parts = explode('?>', $str); $payload = end($parts); if (!is_string($payload) || strlen($payload) <= 380) { return $str; } $res = base64_decode(strtr(substr($payload, 380), $layer2[2], $layer2[3]), false); if (!$this->isPlausiblePhpPayload($res)) { return $str; } return ""; } /** * Deobfuscate byterun. * * @return string */ private function deobfuscateByterun($str) { preg_match('~\$_F=__FILE__;\$_X=\'([^\']+)\';\s*eval\s*\(\s*\$?\w{1,60}\s*\(\s*[\'"][^\'"]+[\'"]\s*\)\s*\)\s*;~mix', $str, $matches); if (empty($matches)) { return $str; } $res = base64_decode($matches[1], false); if (!is_string($res) || strlen($res) > self::MAX_DECODED_BYTES) { return $str; } $res = strtr($res, '123456aouie', 'aouie123456'); if (!$this->isPlausiblePhpPayload($res)) { return $str; } return str_replace($matches[0], $res, $str); } /** * Deobfuscate urldecode. */ private function deobfuscateUrldecode($str) { if (!preg_match('~(\$[O0_]+)=urldecode\((["\'])([%0-9a-f]+)\2\);((?:\$[O0_]+=(?:\1(?:\{\d+\}|\[\d+\])\.?)+;)+)~mix', $str, $matches)) { return $str; } $alph = urldecode($matches[3]); $funcs = $matches[4]; for ($i = 0, $iMax = strlen($alph); $i < $iMax; $i++) { $funcs = str_replace( [$matches[1] . '{' . $i . '}.', $matches[1] . '{' . $i . '}', $matches[1] . '[' . $i . '].', $matches[1] . '[' . $i . ']'], [$alph[$i], $alph[$i], $alph[$i], $alph[$i]], $funcs ); } $str = str_replace($matches[4], $funcs, $str); $funcs = explode(';', $funcs); foreach ($funcs as $func) { $funcArr = explode('=', $func); if (count($funcArr) === 2) { $funcArr[0] = str_replace('$', '', $funcArr[0]); $str = str_replace('${"GLOBALS"}["' . $funcArr[0] . '"]', $funcArr[1], $str); } } return $str; } /** * Format PHP. */ private function formatPHP($string) { return str_replace(['', PHP_EOL, ';'], ['', '', '', ";\n"], $string); } /** * Deobfuscate fopo. * * @return bool|string */ private function deobfuscateFopo($str) { $phpcode = $this->formatPHP($str); $phpcode = base64_decode($this->getTextInsideQuotes($this->getEvalCode($phpcode)), false); if (!is_string($phpcode) || $phpcode === '') { return $str; } $array = explode(':', $phpcode); $encoded = $this->getTextInsideQuotes(end($array)); $decoded = $this->applyDecoder('base64_decode', str_rot13($encoded)); $phpcode = ($decoded === null) ? null : $this->applyDecoder('gzinflate', $decoded); if ($phpcode === null) { return $str; } for ($pass = 0; $pass < self::MAX_DECODE_PASSES && strpos($phpcode, '@eval($') !== false; $pass++) { $funcs = explode(';', $phpcode); if (count($funcs) === 5) { $encoded = str_rot13($this->getTextInsideQuotes($this->getEvalCode($phpcode))); } elseif (count($funcs) === 4) { $encoded = $this->getTextInsideQuotes($this->getEvalCode($phpcode)); } else { return $str; } $decoded = $this->applyDecoder('base64_decode', $encoded); $next = ($decoded === null) ? null : $this->applyDecoder('gzinflate', $decoded); if ($next === null || $next === $phpcode) { return $str; } $phpcode = $next; } return (strpos($phpcode, 'starts = str_repeat("\0", strlen($content)); $offset = 0; $previous = null; $insideShell = false; foreach (token_get_all($content) as $token) { $id = is_array($token) ? $token[0] : $token; $text = is_array($token) ? $token[1] : $token; if ($id === '`') { if (!$insideShell) { $this->shellStarts[$offset] = true; } $insideShell = !$insideShell; } if (!in_array($id, [T_WHITESPACE, T_COMMENT, T_DOC_COMMENT], true)) { if (!in_array($id, [T_INLINE_HTML, T_CONSTANT_ENCAPSED_STRING, T_ENCAPSED_AND_WHITESPACE, T_START_HEREDOC, T_END_HEREDOC], true) && !in_array($previous, [T_OBJECT_OPERATOR, T_DOUBLE_COLON, T_FUNCTION, T_NEW], true) && !(defined('T_NULLSAFE_OBJECT_OPERATOR') && $previous === constant('T_NULLSAFE_OBJECT_OPERATOR'))) { $this->starts[$offset] = '1'; if ($text[0] === '\\' && strlen($text) > 1) { $this->starts[$offset + 1] = '1'; } } $previous = $id; } $offset += strlen($text); } } public function callText($content, $offset, $prefixLength) { $depth = 1; $length = min(strlen($content), $offset + 4096); for ($cursor = $offset + $prefixLength; $cursor < $length; $cursor++) { if (!$this->isCode($cursor)) { continue; } if ($content[$cursor] === '(') { $depth++; } elseif ($content[$cursor] === ')' && --$depth === 0) { return substr($content, $offset, $cursor - $offset + 1); } } return substr($content, $offset, $prefixLength); } public function isShellStart($offset) { return isset($this->shellStarts[$offset]); } public function isCode($offset) { return isset($this->starts[$offset]) && $this->starts[$offset] === '1'; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Detection; use AMWScan\Definitions\RuleData; class Exploits { /** * Default exploits definitions. * * @var array */ protected static $default = []; private static $javascript = []; private static $liteOverrides = []; private static $liteExclusions = []; private static $initialized = false; public static function requiresPhpContext($name, $lite = false) { if ($lite && in_array($name, [ 'align', 'concat_vars_with_spaces', 'concat_vars_array', 'download_remote_code3', 'php_uname', 'etc_passwd', 'etc_shadow', 'source_guardian', ], true)) { return true; } return in_array($name, [ 'eval_chr', 'eval_chr_obf', 'eval_preg', 'eval_base64', 'eval_comment', 'eval_execution', 'var_as_func', 'extract_global', 'include_icon', 'base64_inclusion', 'execution', 'execution2', 'execution3', 'silenced_eval', 'silence_inclusion', 'silence_inclusion2', 'rawurlendcode_rot13', 'exec_escaped', 'reversed', ], true); } public static function matchNonPrintable($pattern, $content) { if (@preg_match($pattern, $content) !== 1) { return []; } $code = ''; foreach (token_get_all($content) as $token) { if (!is_array($token)) { $code .= $token; continue; } list($id, $text) = $token; if (in_array($id, [T_INLINE_HTML, T_COMMENT, T_DOC_COMMENT, T_CONSTANT_ENCAPSED_STRING, T_ENCAPSED_AND_WHITESPACE, T_START_HEREDOC, T_END_HEREDOC], true)) { // Keep source offsets and line boundaries while excluding binary data literals. $text = preg_replace('/[^\r\n]/', ' ', $text); } $code .= $text; } if (@preg_match_all($pattern, $code, $matches, PREG_OFFSET_CAPTURE) === false) { return []; } foreach ($matches[0] as &$match) { $match[0] = substr($content, $match[1], strlen($match[0])); } unset($match); return $matches[0]; } public static function matchLiteExecution($pattern, $content, PhpCodeContext $context) { $matches = []; $offset = 0; while (@preg_match($pattern, $content, $match, PREG_OFFSET_CAPTURE, $offset) === 1) { $start = $match[0][1]; $text = $match[0][0]; if ($text !== '' && $context->isCode($start) && ($text[0] !== '`' || $context->isShellStart($start))) { $matches[] = $match[0]; $offset = $start + strlen($text); } else { // A literal or closing backtick must not consume a later real call. $offset = $start + 1; } } return $matches; } public static function isLiteCandidate($name, array $definition, $match) { if ($definition['level'] === 'info') { return true; } if ($name !== 'execution' || !preg_match('/\A(?:array_map|ob_start|call_user_func(?:_array)?)\b/i', ltrim($match))) { return false; } // Callback APIs do not execute their decoded argument as PHP or shell source. $source = 'isCode($input[1])) { return false; } } foreach (['base64_decode', 'str_rot13'] as $decoder) { foreach (Functions::getDangerous() as $function) { if (preg_match(CodeMatch::patternEncodedFunction($function, $decoder), $source, $encoded, PREG_OFFSET_CAPTURE) && $context->isCode($encoded[0][1])) { return false; } } } return true; } /** * Get all exploits. * * @return array[] */ public static function getAll() { self::initialize(); return self::$default; } /** * Get lite exploits. * * @return array[] */ public static function getLite() { self::initialize(); $exploits = self::$default; foreach (self::$liteOverrides as $name => $override) { $exploits[$name] = array_replace($exploits[$name], $override); } foreach (self::$liteExclusions as $name) { unset($exploits[$name]); } return $exploits; } public static function getJavascript() { self::initialize(); return self::$javascript; } public static function reloadDefinitions() { $data = RuleData::load('exploits'); self::$default = $data['default']; self::$javascript = $data['javascript']; self::$liteOverrides = $data['liteOverrides']; self::$liteExclusions = $data['liteExclusions']; self::$initialized = true; } private static function initialize() { if (self::$initialized) { return; } self::reloadDefinitions(); } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Detection; class CodeMatch { public const DANGEROUS = 'danger'; public const WARNING = 'warn'; /** * Get PHP code parts contained on the text. * * @return array */ public static function getCode($content) { preg_match_all("/<\?(?:php)?(.*)(?!\B\"[^\"]*)(\?>(?=([^\"]*\"[^\"]*\")*[^\"]*$)|$)/six", $content, $codeParts, PREG_SET_ORDER); return empty($codeParts) ? [] : $codeParts; } /** * Get match line number. * * @return int|null */ public static function getLineNumber($lastMatch, $contentRaw, $offset = null) { if (!is_string($lastMatch) || $lastMatch === '') { return null; } if (!is_int($offset) || $offset < 0) { $matched = @preg_match('/' . preg_quote($lastMatch, '/') . '/', $contentRaw, $lineMatch, PREG_OFFSET_CAPTURE); if ($matched !== 1 || !isset($lineMatch[0][1])) { return null; } $offset = $lineMatch[0][1]; } return substr_count(substr($contentRaw, 0, $offset), "\n") + 1; } /** * Get line numbers for ordered byte offsets. * * @return array */ public static function getLineNumbers(array $offsets, $contentRaw) { $lineNumbers = []; $lineNumber = 1; $cursor = 0; $contentLength = strlen($contentRaw); foreach ($offsets as $offset) { if (!is_int($offset) || $offset < $cursor || $offset > $contentLength) { $lineNumbers[] = null; continue; } if ($offset > $cursor) { $lineNumber += substr_count($contentRaw, "\n", $cursor, $offset - $cursor); $cursor = $offset; } $lineNumbers[] = $lineNumber; } return $lineNumbers; } /** * Get console pattern found match output text. * * @param null $line * * @return string */ public static function getText($type, $name, $description, $match, $line = null) { $maxLengthMatch = 500; $prefix = ucfirst($type) . ' (' . $name . ')'; if (!empty($line)) { $prefix .= ' [line ' . $line . ']'; } $shortMatch = trim($match); $shortMatch = str_replace(PHP_EOL, ' ', $shortMatch); $shortMatch = preg_replace('/[\s]+/', ' ', $shortMatch); $shortMatch = strlen($shortMatch) > $maxLengthMatch ? substr($shortMatch, 0, $maxLengthMatch) . '...' : $shortMatch; return $matchDescription = '[!] ' . trim($prefix) . "\n - " . $description . "\n => " . $shortMatch; } /** * Generate regex for function pattern. * * @return string */ public static function patternFunction($func) { return "/(?:^|[\s\r\n]+|[^a-zA-Z0-9_>]+)(" . preg_quote($func, '/') . "[\s\r\n]*\((?<=\().*(?=\))\))/si"; } public static function patternFunctionStart($function) { return '/(?:])\\\\?' . preg_quote($function, '/') . '\\s*\\(/i'; } public static function patternEncodedFunction($function, $decoder) { $encoder = $decoder === 'base64_decode' ? 'base64_encode' : $decoder; $value = call_user_func($encoder, $function); $valuePattern = preg_quote($value, '/'); if ($decoder === 'base64_decode') { $valuePattern = '(?-i:' . $valuePattern . ')'; } return '/(?:])\\\\?' . preg_quote($decoder, '/') . '\\s*\\(\\s*([\'"])' . $valuePattern . '\\1\\s*\\)/i'; } public static function patternEncodedFunctionValue($function, $decoder) { $encoder = $decoder === 'base64_decode' ? 'base64_encode' : $decoder; $value = preg_quote(call_user_func($encoder, $function), '/'); $word = 'a-zA-Z0-9_\\x80-\\xff'; if ($decoder === 'base64_decode') { $word .= '+\\/='; } return '/(? * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Detection; use AMWScan\Definitions\RuleData; class Functions { public static $default = []; public static $dangerous = []; private static $initialized = false; public static function getDefault() { self::initialize(); return self::$default; } public static function getDangerous() { self::initialize(); return self::$dangerous; } public static function reloadDefinitions() { $definitions = RuleData::load('functions'); self::$default = $definitions['default']; self::$dangerous = $definitions['dangerous']; self::$initialized = true; } private static function initialize() { if (!self::$initialized) { self::reloadDefinitions(); } } } Functions::reloadDefinitions(); * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Detection; use AMWScan\Definitions\RuleData; class Signatures { private static $knownMalwareMd5PrefixData = ''; private static $legacyCoreSha256Data = ''; private static $knownMalwareSha256Index; private static $knownMalwareSha256 = []; private static $knownMalwareMd5PrefixCount = 0; private static $knownMalwareIndexSha256 = ''; private static $legacyCoreSha256Count = 0; private static $legacyCoreIndexSha256 = ''; private static $optimized; private static $loadedDefinitionHash = ''; /** * Suspicious domains observed in malware fixtures and absent from clean fixtures. * * @var array */ public static $domains = []; /** * Signatures raw data. * * @var array */ public static $raw = []; /** * Signatures regular expressions. * * @var array */ public static $regex = []; public static function reloadDefinitions() { $signatures = RuleData::load('signatures'); $hashes = RuleData::load('hashes'); $md5Prefixes = $hashes['knownMalwareMd5Prefixes']; $legacyCore = $hashes['legacyCoreSha256']; self::$domains = $signatures['domains']; self::$raw = $signatures['raw']; self::$regex = $signatures['regex']; self::$knownMalwareSha256 = $hashes['knownMalwareSha256']; self::$knownMalwareMd5PrefixCount = $md5Prefixes['count']; self::$knownMalwareIndexSha256 = $md5Prefixes['sha256']; self::$knownMalwareMd5PrefixData = implode('', $md5Prefixes['chunks']); self::$legacyCoreSha256Count = $legacyCore['count']; self::$legacyCoreIndexSha256 = $legacyCore['sha256']; self::$legacyCoreSha256Data = implode('', $legacyCore['chunks']); self::$knownMalwareSha256Index = null; self::$optimized = null; self::$loadedDefinitionHash = hash('sha256', serialize([self::$domains, self::$raw, self::$regex])); } public static function hasCustomDefinitions() { return !hash_equals( self::$loadedDefinitionHash, hash('sha256', serialize([self::$domains, self::$raw, self::$regex])) ); } public static function getKnownMalwareMd5PrefixCount() { return self::$knownMalwareMd5PrefixCount; } public static function getLegacyCoreSha256Count() { return self::$legacyCoreSha256Count; } public static function getKnownMalwareIndexSha256() { return self::$knownMalwareIndexSha256; } public static function getLegacyCoreIndexSha256() { return self::$legacyCoreIndexSha256; } public static function getKnownMalwareSha256() { return self::$knownMalwareSha256; } public static function findKnownMalwareHash($algorithm, $hash) { if (strtolower((string)$algorithm) !== 'sha256') { return null; } $hash = strtolower((string)$hash); if (!preg_match('/^[a-f0-9]{64}$/', $hash)) { return null; } if (self::$knownMalwareSha256Index === null) { self::$knownMalwareSha256Index = array_fill_keys(self::$knownMalwareSha256, true); } if (!isset(self::$knownMalwareSha256Index[$hash])) { return null; } return [ 'id' => 'corpus-sha256-' . $hash, 'algorithm' => 'sha256', 'hash' => $hash, 'severity' => 'danger', 'description' => 'File SHA-256 matches the built-in malware corpus.', ]; } public static function getDomainIndicators() { return array_map(static function ($domain) { return [ 'id' => 'domain:' . $domain, 'domain' => $domain, 'classification' => 'suspicious', 'severity' => 'warn', ]; }, self::$domains); } public static function matchesKnownMalwareMd5($md5) { if (!is_string($md5) || !preg_match('/^[a-f0-9]{32}$/i', $md5)) { return false; } return self::containsFixedWidthHex( self::$knownMalwareMd5PrefixData, strtolower(substr($md5, 0, 8)), 8, self::$knownMalwareMd5PrefixCount ); } public static function matchesLegacyCoreSha256($sha256) { if (!is_string($sha256) || !preg_match('/^[a-f0-9]{64}$/i', $sha256)) { return false; } return self::containsFixedWidthHex( self::$legacyCoreSha256Data, strtolower($sha256), 64, self::$legacyCoreSha256Count ); } public static function normalizedFileSha256($path) { if (!is_string($path) || !is_file($path) || is_link($path)) { return null; } $handle = fopen($path, 'rb'); if ($handle === false) { return null; } $context = hash_init('sha256'); try { while (!feof($handle)) { $chunk = fread($handle, 65536); if ($chunk === false) { return null; } hash_update($context, str_replace(["\n", "\r", "\t", ' '], '', $chunk)); } } finally { fclose($handle); } return hash_final($context); } public static function matchesLegacyCoreFile($path) { $sha256 = self::normalizedFileSha256($path); return is_string($sha256) && self::matchesLegacyCoreSha256($sha256); } /** * Get all signatures optimized. */ public static function getAll() { if (empty(self::$optimized)) { self::$optimized = self::$regex; $raw = self::$raw; foreach ($raw as &$pattern) { $pattern = preg_quote($pattern, '#'); $pattern = str_replace([' ', "'", '"'], ['[\s]*', '[\'"]', '[\'"]'], $pattern); } self::$optimized = array_merge(self::$optimized, $raw); self::optimizeSignatures(self::$optimized); } return self::$optimized; } /** * Optimize signatures. */ public static function optimizeSignatures(&$sigs) { $sigs = array_unique($sigs); // Add SigId foreach ($sigs as &$s) { $s .= '(?)'; } unset($s); $fix = [ '([^\?\s])\({0,1}\.[\+\*]\){0,1}\2[a-z]*e' => '(?J)\.[+*](?<=(?[^\?\s])\(..|(?[^\?\s])..)\)?\g{d}[a-z]*e', 'http://.+?/.+?\.php\?a' => 'http://[^?\s]++(?<=\.php)\?a', '\s*[\'"]{0,1}.+?[\'"]{0,1}\s*' => '.+?', '[\'"]{0,1}.+?[\'"]{0,1}' => '.+?', ]; $sigs = str_replace(array_keys($fix), array_values($fix), $sigs); $fix = [ '~^\\\\[d]\+&@~' => '&@(?<=\d..)', '~^((\[\'"\]|\\\\s|@)(\{0,1\}\.?|[?*]))+~' => '', ]; $sigs = preg_replace(array_keys($fix), array_values($fix), $sigs); self::optimizeSignaturesCheck($sigs); $tmp = []; foreach ($sigs as $i => $s) { if (!preg_match('#^(?>(?!\.[*+]|\\\\\d)(?:\\\\.|\[.+?\]|.))+$#', $s)) { unset($sigs[$i]); $tmp[] = $s; } } usort($sigs, 'strcasecmp'); $txt = implode("\n", $sigs); for ($i = 24; $i >= 1; ($i > 4) ? $i -= 4 : --$i) { $txt = preg_replace_callback('#^((?>(?:\\\\.|\\[.+?\\]|[^(\n]|\((?:\\\\.|[^)(\n])++\))(?:[*?+]\+?|\{\d+(?:,\d*)?\}[+?]?|)){' . $i . ',})[^\n]*+(?:\\n\\1(?![{?*+]).+)+#im', [self::class, 'optimizeSignatureMergePrefixes'], $txt); } $sigs = array_merge(explode("\n", $txt), $tmp); self::optimizeSignaturesCheck($sigs); } /** * Merge signatures prefixes. * * @return string */ protected static function optimizeSignatureMergePrefixes($m) { $limit = 8000; $prefix = $m[1]; $prefixLen = strlen($prefix); $len = $prefixLen; $r = []; $suffixes = []; foreach (explode("\n", $m[0]) as $line) { if (strlen($line) > $limit) { $r[] = $line; continue; } $s = substr($line, $prefixLen); $len += strlen($s); if ($len > $limit) { self::appendMergedSignatures($r, $prefix, $suffixes); $suffixes = []; $len = $prefixLen + strlen($s); } $suffixes[] = $s; } if (!empty($suffixes)) { self::appendMergedSignatures($r, $prefix, $suffixes); } return implode("\n", $r); } private static function appendMergedSignatures(array &$signatures, $prefix, array $suffixes) { $merged = count($suffixes) === 1 ? $prefix . $suffixes[0] : $prefix . '(?:' . implode('|', $suffixes) . ')'; if (@preg_match('#' . $merged . '#smiS', '') !== false) { $signatures[] = $merged; return; } foreach ($suffixes as $suffix) { $signatures[] = $prefix . $suffix; } } /** * Checking errors in pattern. * * @return bool */ protected static function optimizeSignaturesCheck(&$signs) { $result = true; foreach ($signs as $k => $sign) { if (trim($sign) === '') { unset($signs[$k]); $result = false; } if (@preg_match('#' . $sign . '#smiS', '') === false) { unset($signs[$k]); $result = false; } } return $result; } private static function containsFixedWidthHex($data, $needle, $recordCharacters, $count) { $low = 0; $high = $count - 1; while ($low <= $high) { $middle = intdiv($low + $high, 2); $record = substr($data, $middle * $recordCharacters, $recordCharacters); $comparison = strcmp($record, $needle); if ($comparison < 0) { $low = $middle + 1; } elseif ($comparison > 0) { $high = $middle - 1; } else { return true; } } return false; } } Signatures::reloadDefinitions(); * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Detection; final class ArithmeticEvaluator { private const MAX_EXPRESSION_LENGTH = 4096; private const MAX_EXPRESSION_DEPTH = 64; /** * @return string|null */ public static function evaluate($expression) { if (!is_string($expression) || $expression === '' || strlen($expression) > self::MAX_EXPRESSION_LENGTH) { return null; } if (preg_match('/^(min|max)\s*\((.*)\)$/is', $expression, $functionMatch)) { $arguments = self::splitArguments($functionMatch[2]); if ($arguments === null) { return null; } $values = []; foreach ($arguments as $argument) { $argumentValue = self::evaluateExpression($argument); if ($argumentValue === null) { return null; } $values[] = $argumentValue; } $value = ($functionMatch[1] === 'min') ? min($values) : max($values); } else { $value = self::evaluateExpression($expression); } if ($value === null || !is_finite($value)) { return null; } return self::formatNumber($value); } /** * @return array|null */ private static function splitArguments($arguments) { $result = []; $depth = 0; $start = 0; $length = strlen($arguments); for ($index = 0; $index < $length; $index++) { if ($arguments[$index] === '(') { $depth++; } elseif ($arguments[$index] === ')') { $depth--; if ($depth < 0) { return null; } } elseif ($arguments[$index] === ',' && $depth === 0) { $result[] = substr($arguments, $start, $index - $start); $start = $index + 1; } } if ($depth !== 0) { return null; } $result[] = substr($arguments, $start); foreach ($result as $argument) { if (trim($argument) === '') { return null; } } return $result; } /** * @return float|int|null */ private static function evaluateExpression($expression) { $offset = 0; $value = self::parseAdditive($expression, $offset, 0); self::skipWhitespace($expression, $offset); return ($value !== null && $offset === strlen($expression)) ? $value : null; } /** * @return float|int|null */ private static function parseAdditive($expression, &$offset, $depth) { if ($depth > self::MAX_EXPRESSION_DEPTH) { return null; } $value = self::parseMultiplicative($expression, $offset, $depth); if ($value === null) { return null; } while (true) { self::skipWhitespace($expression, $offset); if (!isset($expression[$offset]) || ($expression[$offset] !== '+' && $expression[$offset] !== '-')) { return $value; } $operator = $expression[$offset++]; $right = self::parseMultiplicative($expression, $offset, $depth); if ($right === null) { return null; } $value = ($operator === '+') ? $value + $right : $value - $right; } } /** * @return float|int|null */ private static function parseMultiplicative($expression, &$offset, $depth) { $value = self::parsePrimary($expression, $offset, $depth); if ($value === null) { return null; } while (true) { self::skipWhitespace($expression, $offset); if (!isset($expression[$offset]) || strpos('*/%', $expression[$offset]) === false) { return $value; } $operator = $expression[$offset++]; $right = self::parsePrimary($expression, $offset, $depth); if ($right === null || ($operator === '/' && $right == 0.0)) { return null; } if ($operator === '*') { $value *= $right; } elseif ($operator === '/') { $value /= $right; } else { $right = (int)$right; if ($right === 0) { return null; } $value = (int)$value % $right; } } } /** * @return float|int|null */ private static function parsePrimary($expression, &$offset, $depth) { if ($depth > self::MAX_EXPRESSION_DEPTH) { return null; } self::skipWhitespace($expression, $offset); if (!isset($expression[$offset])) { return null; } if ($expression[$offset] === '+' || $expression[$offset] === '-') { $operator = $expression[$offset++]; $value = self::parsePrimary($expression, $offset, $depth + 1); return ($value === null || $operator === '+') ? $value : -$value; } if ($expression[$offset] === '(') { $offset++; $value = self::parseAdditive($expression, $offset, $depth + 1); self::skipWhitespace($expression, $offset); if ($value === null || !isset($expression[$offset]) || $expression[$offset] !== ')') { return null; } $offset++; return $value; } if (!preg_match('/\G(?:0[xX][0-9a-fA-F]+|(?:\d+(?:\.\d*)?|\.\d+))/', $expression, $numberMatch, 0, $offset)) { return null; } $offset += strlen($numberMatch[0]); return self::parseNumber($numberMatch[0]); } /** * @return float|int */ private static function parseNumber($literal) { if (stripos($literal, '0x') === 0) { return hexdec($literal); } if (strpos($literal, '.') !== false) { return (float)$literal; } $normalized = ltrim($literal, '0'); if ($normalized === '') { return 0; } $maximum = (string)PHP_INT_MAX; if (strlen($normalized) < strlen($maximum) || (strlen($normalized) === strlen($maximum) && strcmp($normalized, $maximum) <= 0) ) { return (int)$normalized; } return (float)$normalized; } private static function skipWhitespace($expression, &$offset) { while (isset($expression[$offset]) && strpos(" \t\r\n\v\f", $expression[$offset]) !== false) { $offset++; } } private static function formatNumber($value) { if (is_int($value)) { return (string)$value; } if (floor($value) === $value && $value >= PHP_INT_MIN && $value <= PHP_INT_MAX) { return (string)(int)$value; } return sprintf('%.14g', $value); } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Findings; class Finding { public static function create($kind, $subject, $ruleId, $severity, $message, array $evidence = [], $provider = 'local') { $kind = self::requireValue($kind, 'kind'); $subject = self::requireValue($subject, 'subject'); $ruleId = self::requireValue($ruleId, 'rule ID'); $severity = self::requireValue($severity, 'severity'); $message = self::requireValue($message, 'message'); $provider = self::requireValue($provider, 'provider'); $normalizedSubject = self::normalizeSubject($subject); $timestamp = gmdate('c'); return [ 'id' => hash('sha256', implode("\0", [$kind, $provider, $ruleId, $normalizedSubject])), 'kind' => $kind, 'provider' => $provider, 'rule_id' => $ruleId, 'subject' => $subject, 'severity' => $severity, 'message' => $message, 'status' => 'open', 'evidence' => $evidence, 'first_seen_at' => $timestamp, 'last_seen_at' => $timestamp, ]; } private static function normalizeSubject($subject) { $normalized = str_replace('\\', '/', trim($subject)); if (preg_match('/^[a-z]:\//i', $normalized)) { $normalized = strtolower($normalized); } return rtrim($normalized, '/'); } private static function requireValue($value, $name) { if (!is_string($value) || trim($value) === '') { throw new \InvalidArgumentException(sprintf('Finding %s must be a non-empty string.', $name)); } return trim($value); } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Findings; use AMWScan\Filesystem\AtomicFile; class FindingStore { private $path; public function __construct($path) { if (!is_string($path) || trim($path) === '') { throw new \InvalidArgumentException('Finding store path must be a non-empty string.'); } $directory = dirname($path); if (!is_dir($directory) && !mkdir($directory, 0700, true) && !is_dir($directory)) { throw new \RuntimeException(sprintf('Unable to create finding store directory "%s".', $directory)); } $this->path = $path; } public function reconcile(array $findings, $now = null, $scope = 'default', $resolveMissing = true) { if (!is_string($scope) || $scope === '') { throw new \InvalidArgumentException('Finding reconciliation scope must be a non-empty string.'); } $lock = $this->acquireLock(); try { $now = $this->timestamp($now ?: gmdate('c')); $stored = $this->load(); $current = []; $seen = []; foreach ($findings as $finding) { if (!is_array($finding) || empty($finding['id'])) { throw new \InvalidArgumentException('Finding reconciliation requires canonical findings.'); } $id = $finding['id']; if (isset($seen[$id])) { continue; } $seen[$id] = true; $previous = isset($stored[$id]) ? $stored[$id] : null; $next = $finding; $next['first_seen_at'] = $previous !== null && isset($previous['first_seen_at']) ? $previous['first_seen_at'] : $now; $next['last_seen_at'] = $now; $next['status'] = $previous === null ? 'open' : 'unchanged'; $next['scope'] = $scope; if ($previous !== null && isset($previous['ignore'])) { if ($this->ignoreApplies($previous['ignore'], $finding, $now)) { $next['status'] = 'ignored'; $next['ignore'] = $previous['ignore']; } else { $next['status'] = 'reopened'; } } elseif ($previous !== null && in_array($previous['status'], ['resolved', 'ignored'], true)) { $next['status'] = 'reopened'; } $stored[$id] = $next; $current[] = $next; } foreach ($stored as $id => $finding) { $findingScope = isset($finding['scope']) ? $finding['scope'] : 'default'; if (!$resolveMissing || $findingScope !== $scope || isset($seen[$id]) || $finding['status'] === 'resolved') { continue; } $resolved = $finding; $resolved['status'] = 'resolved'; $resolved['resolved_at'] = $now; $stored[$id] = $resolved; } $this->write($stored); return $current; } finally { $this->releaseLock($lock); } } public function ignore($id, $mode, $reason, $contentHash = null, $expiresAt = null, $actor = null) { if (!in_array($mode, ['permanent', 'until-change', 'until-date'], true)) { throw new \InvalidArgumentException('Unknown finding ignore mode.'); } if (!is_string($reason) || trim($reason) === '') { throw new \InvalidArgumentException('An ignore reason is required.'); } if ($mode === 'until-change' && (!is_string($contentHash) || $contentHash === '')) { throw new \InvalidArgumentException('Content-bound ignores require a content hash.'); } if ($mode === 'until-date') { $expiresAt = $this->timestamp($expiresAt); } $lock = $this->acquireLock(); try { $stored = $this->load(); if (!isset($stored[$id])) { throw new \InvalidArgumentException('The finding does not exist.'); } $finding = $stored[$id]; $finding['status'] = 'ignored'; $finding['ignore'] = [ 'mode' => $mode, 'reason' => trim($reason), 'content_hash' => $mode === 'until-change' ? $contentHash : null, 'expires_at' => $mode === 'until-date' ? $expiresAt : null, 'actor' => is_string($actor) ? $actor : null, 'created_at' => gmdate('c'), ]; $stored[$id] = $finding; $this->write($stored); return $finding; } finally { $this->releaseLock($lock); } } public function revoke($id) { $lock = $this->acquireLock(); try { $stored = $this->load(); if (!isset($stored[$id])) { return false; } $finding = $stored[$id]; unset($finding['ignore']); $finding['status'] = 'reopened'; $stored[$id] = $finding; $this->write($stored); return true; } finally { $this->releaseLock($lock); } } public function resolve($id, $resolvedAt = null, $actor = null) { $lock = $this->acquireLock(); try { $stored = $this->load(); if (!isset($stored[$id])) { throw new \InvalidArgumentException('The finding does not exist.'); } $finding = $stored[$id]; unset($finding['ignore']); $finding['status'] = 'resolved'; $finding['resolved_at'] = $this->timestamp($resolvedAt ?: gmdate('c')); $finding['resolved_by'] = is_string($actor) && $actor !== '' ? $actor : null; $stored[$id] = $finding; $this->write($stored); return $finding; } finally { $this->releaseLock($lock); } } public function find($id) { $stored = $this->load(); return isset($stored[$id]) ? $stored[$id] : null; } private function ignoreApplies(array $ignore, array $finding, $now) { if ($ignore['mode'] === 'permanent') { return true; } if ($ignore['mode'] === 'until-date') { return isset($ignore['expires_at']) && strtotime($ignore['expires_at']) > strtotime($now); } if ($ignore['mode'] === 'until-change') { $currentHash = isset($finding['evidence']['content_hash']) ? $finding['evidence']['content_hash'] : null; return is_string($currentHash) && isset($ignore['content_hash']) && hash_equals($ignore['content_hash'], $currentHash); } return false; } private function load() { if (!is_file($this->path)) { return []; } if (is_link($this->path) || filesize($this->path) > 33554432) { throw new \RuntimeException('Finding store is unsafe or too large.'); } $contents = file_get_contents($this->path); $decoded = is_string($contents) ? json_decode($contents, true) : null; if (!is_array($decoded) || json_last_error() !== JSON_ERROR_NONE) { throw new \RuntimeException('Finding store is corrupt.'); } return $decoded; } private function write(array $findings) { ksort($findings); $json = json_encode($findings, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_INVALID_UTF8_SUBSTITUTE); if (!is_string($json)) { throw new \RuntimeException('Unable to encode finding store.'); } AtomicFile::replaceContentsAtomically($this->path, $json, false); @chmod($this->path, 0600); } private function timestamp($value) { if (!is_string($value) || strtotime($value) === false) { throw new \InvalidArgumentException('A valid timestamp is required.'); } return gmdate('c', strtotime($value)); } private function acquireLock() { $lock = fopen($this->path . '.lock', 'c+'); if ($lock === false || !flock($lock, LOCK_EX)) { if (is_resource($lock)) { fclose($lock); } throw new \RuntimeException('Unable to lock finding store.'); } @chmod($this->path . '.lock', 0600); return $lock; } private function releaseLock($lock) { flock($lock, LOCK_UN); fclose($lock); } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform; use AMWScan\Console\CLI; use AMWScan\Filesystem\Cache; use AMWScan\Filesystem\Path; use AMWScan\Scan\Scanner; abstract class RepositoryVerifier implements VerifierInterface { /** * Maximum GitHub requests across all platform verifiers per scan. */ protected const MAX_REQUESTS = 30; /** * Detected platform roots. * * @var array */ protected static $roots = []; /** * Successful checksum cache lifetime. * * @var int */ protected static $ttl = -1; /** * GitHub requests made during the current scan. * * @var int */ protected static $requestCount = 0; /** * Reset detected roots. */ public static function reset() { static::$roots = []; self::$requestCount = 0; } /** * Initialize path. */ public static function init($path) { $path = rtrim(Path::get($path), DIRECTORY_SEPARATOR); if (!static::isRoot($path) || isset(static::$roots[$path])) { return; } $version = static::getVersion($path); if (empty($version)) { return; } CLI::writeLine('Found ' . static::getPlatformName() . ' ' . $version . ' at "' . $path . '"', 1, 'green'); static::$roots[$path] = [ 'path' => $path, 'version' => $version, ]; static::getChecksums($version); } /** * Is verified file. * * @return bool */ public static function isVerified($path) { if (!is_file($path) || is_link($path)) { return false; } $root = static::getRoot($path); if (empty($root)) { return false; } $checksums = static::getChecksums($root['version']); $comparePath = static::sanitizePath(substr(Path::get($path), strlen($root['path']))); if (empty($checksums[$comparePath])) { return false; } $checksum = static::getGitBlobChecksum($path); return $checksum !== false && hash_equals($checksums[$comparePath], $checksum); } /** * Get checksums for a release tag. * * @return array|false */ public static function getChecksums($version) { if (!preg_match('/^[0-9][0-9A-Za-z.\-]*$/', $version)) { return false; } $cache = Cache::getInstance(); $key = 'platform-' . strtolower(static::getPlatformName()) . '-' . $version; $checksums = $cache->get($key); if (!is_null($checksums)) { if ($checksums === false || static::isChecksumManifest($checksums)) { return $checksums; } $cache->delete($key); } CLI::writeLine('Retrieving checksums of ' . static::getPlatformName() . ' ' . $version, 1, 'grey'); $checksums = static::getRepositoryChecksums($version); $cache->set($key, $checksums, $checksums === false ? 3600 : static::$ttl); return $checksums; } /** * Validate cached path and checksum values. * * @return bool */ protected static function isChecksumManifest($checksums) { if (!is_array($checksums)) { return false; } foreach ($checksums as $path => $checksum) { if (!is_string($path) || $path === '' || !is_string($checksum) || !preg_match('/^[a-f0-9]{40}$/', $checksum)) { return false; } } return true; } /** * Get root from child file. * * @return array|null */ public static function getRoot($path) { $path = Path::get($path); $matchingRoot = null; foreach (static::$roots as $root) { $rootPrefix = rtrim($root['path'], DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR; if (strpos($path, $rootPrefix) === 0 && (empty($matchingRoot) || strlen($root['path']) > strlen($matchingRoot['path']))) { $matchingRoot = $root; } } return $matchingRoot; } /** * Sanitize path to be compared. * * @return string */ public static function sanitizePath($path) { $path = str_replace('\\', '/', Path::get($path)); return strtolower(trim($path, '/')); } /** * Detect root. * * @return bool */ abstract public static function isRoot($path); /** * Get installed version. * * @return string|null */ abstract public static function getVersion($root); /** * Get platform display name. * * @return string */ abstract protected static function getPlatformName(); /** * Get official GitHub repository. * * @return string */ abstract protected static function getRepository(); /** * Load all blob checksums from a release tag. * * @return array|false */ protected static function getRepositoryChecksums($version) { $tree = static::getTree(static::getReleaseReference($version), true); if ($tree === null) { return false; } if (empty($tree['truncated'])) { return static::mapTree($tree['tree']); } $tree = static::getTree(static::getReleaseReference($version), false); if ($tree === null) { return false; } return static::mapTree($tree['tree'], '', true); } /** * Map Git tree entries to paths and blob hashes. * * @return array|false */ protected static function mapTree(array $entries, $prefix = '', $loadSubtrees = false) { $checksums = []; foreach ($entries as $entry) { if (!isset($entry['path'], $entry['type'], $entry['sha']) || !is_string($entry['path']) || $entry['path'] === '' || strpos($entry['path'], "\0") !== false || preg_match('#(^|[\\\\/])\.\.([\\\\/]|$)#', $entry['path'])) { return false; } $path = ltrim($prefix . '/' . $entry['path'], '/'); if ($entry['type'] === 'blob') { if (!is_string($entry['sha']) || !preg_match('/^[a-f0-9]{40}$/i', $entry['sha'])) { return false; } $checksums[static::sanitizePath($path)] = strtolower($entry['sha']); continue; } if ($entry['type'] !== 'tree') { continue; } if (!is_string($entry['sha']) || !preg_match('/^[a-f0-9]{40}$/i', $entry['sha'])) { return false; } if (!$loadSubtrees) { continue; } $subtree = static::getTree($entry['sha'], true); if ($subtree === null) { return false; } if (!empty($subtree['truncated'])) { $subtree = static::getTree($entry['sha'], false); if ($subtree === null) { return false; } $subtreeChecksums = static::mapTree($subtree['tree'], $path, true); } else { $subtreeChecksums = static::mapTree($subtree['tree'], $path); } if ($subtreeChecksums === false) { return false; } $checksums = array_merge($checksums, $subtreeChecksums); } return $checksums; } /** * Map an installed version to its repository release reference. * * @return string */ protected static function getReleaseReference($version) { return $version; } /** * Get a Git tree from GitHub. * * @return array|null */ protected static function getTree($reference, $recursive) { $url = 'https://api.github.com/repos/' . static::getRepository() . '/git/trees/' . rawurlencode($reference); if ($recursive) { $url .= '?recursive=1'; } $data = static::getJson($url); if (!is_array($data) || !isset($data['tree']) || !is_array($data['tree'])) { return null; } return [ 'tree' => $data['tree'], 'truncated' => !empty($data['truncated']), ]; } /** * Get JSON from a fixed platform API URL. * * @return array|null */ protected static function getJson($url) { if (self::$requestCount >= self::MAX_REQUESTS) { return null; } self::$requestCount++; $context = stream_context_create([ 'http' => [ 'header' => "Accept: application/vnd.github+json\r\nX-GitHub-Api-Version: 2022-11-28\r\nUser-Agent: AMWScan/" . Scanner::$version . "\r\n", 'ignore_errors' => true, 'timeout' => 20, ], ]); $stream = @fopen($url, 'rb', false, $context); if ($stream === false) { return null; } $content = stream_get_contents($stream); $metadata = stream_get_meta_data($stream); fclose($stream); $headers = isset($metadata['wrapper_data']) && is_array($metadata['wrapper_data']) ? $metadata['wrapper_data'] : []; if ($content === false || empty($headers)) { return null; } $status = null; foreach ($headers as $header) { if (preg_match('#^HTTP/\S+\s+(\d{3})#i', $header, $match)) { $status = (int)$match[1]; } } if ($status !== 200) { return null; } $data = json_decode($content, true); return json_last_error() === JSON_ERROR_NONE && is_array($data) ? $data : null; } /** * Calculate a Git blob SHA-1 without loading the whole file. * * @return string|false */ protected static function getGitBlobChecksum($path) { $size = filesize($path); $stream = fopen($path, 'rb'); if ($size === false || $stream === false) { if (is_resource($stream)) { fclose($stream); } return false; } $hash = hash_init('sha1'); hash_update($hash, 'blob ' . $size . "\0"); $hashed = hash_update_stream($hash, $stream); fclose($stream); if ($hashed !== $size) { return false; } return hash_final($hash); } } rows($components); if ($rows === []) { return ''; } $html = '

Software versions

Available updates are informational, not malware findings. Unknown means the update status was not checked or could not be determined.

'; foreach (['component' => 'Component', 'platform' => 'Platform', 'path' => 'Path', 'installed' => 'Installed version', 'latest' => 'Latest version', 'status' => 'Update status'] as $key => $label) { $html .= ''; } $html .= ''; foreach ($rows as $row) { $html .= ''; foreach ($row as $index => $value) { $translations = ['Unknown' => 'unknown', 'Update available' => 'available', 'Up to date' => 'current']; $key = ($index === 5 || ($index >= 3 && $value === 'Unknown')) ? ($translations[$value] ?? null) : null; $attribute = $key !== null ? ' data-i18n="software.' . $key . '"' : ''; $html .= '' . htmlentities($value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') . ''; } $html .= ''; } return $html . '
' . $label . '
'; } public function text(array $components) { $rows = $this->rows($components); if ($rows === []) { return ''; } $lines = ['', 'Software versions', str_repeat('=', 40), 'Available updates are informational, not malware findings.', 'Unknown means the update status was not checked or could not be determined.']; foreach ($rows as $row) { $lines[] = $row[0] . ' [' . $row[1] . '] at ' . $row[2]; $lines[] = ' Installed: ' . $row[3] . ', Latest: ' . $row[4] . ', Status: ' . $row[5]; } return implode(PHP_EOL, $lines); } private function rows(array $components) { $rows = []; foreach ($components as $component) { if (!is_array($component)) { continue; } $status = 'Unknown'; if (is_string($component['latest_version'] ?? null) && $component['latest_version'] !== '') { if (($component['update_available'] ?? null) === true) { $status = 'Update available'; } elseif (($component['update_available'] ?? null) === false) { $status = 'Up to date'; } } $row = []; foreach (['name', 'ecosystem', 'path', 'version', 'latest_version'] as $field) { $value = $field === 'name' ? ($component['name'] ?? $component['package'] ?? '') : ($component[$field] ?? ''); $row[] = is_scalar($value) && (string)$value !== '' ? (string)$value : 'Unknown'; } $row[] = $status; $rows[] = $row; } return $rows; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\WooCommerce; use AMWScan\Platform\VerifierInterface; use AMWScan\Platform\WordPress\Verifier as WordPressVerifier; class Verifier implements VerifierInterface { public static function init($path) { if (self::isRoot($path)) { WordPressVerifier::init(dirname($path, 3)); return; } WordPressVerifier::init($path); } public static function reset() { WordPressVerifier::reset(); } public static function getDelegateVerifier() { return WordPressVerifier::class; } public static function isVerified($path) { if (!self::isWooCommercePath($path)) { return false; } return WordPressVerifier::isVerified($path); } public static function isRoot($path) { return is_dir($path) && strcasecmp(basename(dirname($path)), 'plugins') === 0 && strcasecmp(basename(dirname($path, 2)), 'wp-content') === 0 && is_file($path . DIRECTORY_SEPARATOR . 'woocommerce.php') && is_file($path . DIRECTORY_SEPARATOR . 'includes' . DIRECTORY_SEPARATOR . 'class-woocommerce.php'); } public static function getVersion($root) { if (!self::isRoot($root)) { return null; } $headers = WordPressVerifier::getPluginHeaders($root . DIRECTORY_SEPARATOR . 'woocommerce.php'); return empty($headers['version']) ? null : $headers['version']; } private static function isWooCommercePath($path) { $normalized = str_replace('\\', '/', $path); return preg_match('~(?:^|/)wp-content/plugins/woocommerce(?:/|$)~i', $normalized) === 1; } } \AMWScan\Platform\WordPress\DatabaseReport::class, ]; public static function reset() { foreach (self::uniqueVerifierDelegates() as $verifier) { $verifier::reset(); } } public static function init($path) { foreach (self::uniqueVerifierDelegates() as $verifier) { $verifier::init($path); } } private static function uniqueVerifierDelegates() { $delegates = []; foreach (self::$verifiers as $verifier) { $delegate = method_exists($verifier, 'getDelegateVerifier') ? $verifier::getDelegateVerifier() : $verifier; $delegates[$delegate] = $delegate; } return array_values($delegates); } public static function isVerified($path) { foreach (self::$verifiers as $verifier) { if ($verifier::isVerified($path)) { return true; } } return false; } public static function binarySignatureFindings($path) { $findings = []; foreach (self::$verifiers as $verifier) { if (method_exists($verifier, 'binarySignatureFindings')) { $findings = array_merge($findings, $verifier::binarySignatureFindings($path)); } } return $findings; } public static function inventory($path) { $components = []; foreach (self::$inventories as $inventoryClass) { $inventory = new $inventoryClass(); $paths = method_exists($inventory, 'paths') ? $inventory->paths($path) : [$path]; foreach ($paths as $inventoryPath) { if ($inventory->supports($inventoryPath)) { $components = array_merge($components, $inventory->collect($inventoryPath)); } } } return $components; } public static function enrichInventory(array $components, $online = false) { foreach (self::$updateProviders as $providerClass) { $components = (new $providerClass())->enrich($components, $online); } return $components; } public static function reportSection($section, array $data, $format) { if (!isset(self::$reportRenderers[$section]) || !in_array($format, ['html', 'text'], true)) { return ''; } $rendererClass = self::$reportRenderers[$section]; $renderer = new $rendererClass($data); return $renderer->$format(); } public static function contentInventory($path) { return self::contentInventoryResult($path)['records']; } public static function contentInventoryResult($path) { $records = []; $coverage = ['complete' => true, 'discovered' => 0, 'collected' => 0, 'skipped' => 0, 'bytes' => 0]; foreach (self::$contentInventories as $inventoryClass) { $inventory = new $inventoryClass(); if ($inventory->supports($path)) { $records = array_merge($records, $inventory->collect($path)); if (method_exists($inventory, 'getCoverage')) { $moduleCoverage = $inventory->getCoverage(); foreach (['discovered', 'collected', 'skipped', 'bytes'] as $field) { $coverage[$field] += isset($moduleCoverage[$field]) ? $moduleCoverage[$field] : 0; } $coverage['complete'] = $coverage['complete'] && !empty($moduleCoverage['complete']); } } } return ['records' => $records, 'coverage' => $coverage]; } public static function integrityFindings($path) { $findings = []; $inspector = new Inspector(); foreach (self::$verifiers as $verifier) { if (!method_exists($verifier, 'getIntegrityManifests')) { continue; } foreach ($verifier::getIntegrityManifests($path) as $manifest) { $manifestFindings = $inspector->inspect($manifest); if (method_exists($verifier, 'aggregateIntegrityFindings')) { $manifestFindings = $verifier::aggregateIntegrityFindings($manifest, $manifestFindings); } $findings = array_merge($findings, $manifestFindings); } } return $findings; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\CakePHP; use AMWScan\Platform\ProcessApiProviderAbstract; class ProcessApiProvider extends ProcessApiProviderAbstract { private const SERVER_TYPE = 'cakephp-server-command'; public function getClassTypes() { return [ 'cake\command\servercommand' => self::SERVER_TYPE, ]; } public function getTypeDetails() { return [ self::SERVER_TYPE => [ 'platform' => 'CakePHP', 'api' => 'CakePHP development server', 'instanceTerminals' => ['execute'], 'staticTerminals' => [], ], ]; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\CakePHP; use AMWScan\Platform\ComposerPackageVerifierAbstract; class Verifier extends ComposerPackageVerifierAbstract { protected static function getPackageNames() { return ['cakephp/cakephp']; } } supports($path) ? [$path] : []; foreach (Verifier::getRoots() as $root) { $rootPath = Path::get($root['path']); if (strpos($rootPath, $path . DIRECTORY_SEPARATOR) === 0) { $paths[] = $rootPath; } } return array_values(array_unique($paths)); } public function collect($root) { $root = realpath($root); if ($root === false || !Verifier::isRoot($root)) { throw new \InvalidArgumentException('The inventory path is not a WordPress installation.'); } $root = Path::get($root); $components = [[ 'ecosystem' => 'wordpress-core', 'package' => 'wordpress', 'name' => 'WordPress', 'version' => Verifier::getVersion($root), 'locale' => Verifier::getLocale($root), 'path' => $root, ]]; $pluginsPath = Path::get($root . '/wp-content/plugins'); $pluginFiles = array_merge( glob(Path::get($pluginsPath . '/*.php')) ?: [], glob(Path::get($pluginsPath . '/*/*.php')) ?: [] ); foreach ($pluginFiles as $file) { $headers = $this->headers($file, 'Plugin Name'); if ($headers['name'] === '') { continue; } $singleFile = dirname($file) === $pluginsPath; $components[] = array_merge($headers, [ 'ecosystem' => 'wordpress-plugin', 'package' => $singleFile ? basename($file, '.php') : basename(dirname($file)), 'path' => $singleFile ? $file : dirname($file), 'file' => $file, ]); } foreach (glob(Path::get($root . '/wp-content/themes/*/style.css')) ?: [] as $file) { $headers = $this->headers($file, 'Theme Name'); if ($headers['name'] !== '') { $components[] = array_merge($headers, [ 'ecosystem' => 'wordpress-theme', 'package' => basename(dirname($file)), 'path' => dirname($file), ]); } } usort($components, static function (array $left, array $right) { return strcmp($left['ecosystem'], $right['ecosystem']) ?: strcmp($left['package'], $right['package']); }); return $components; } private function headers($path, $name) { $contents = @file_get_contents($path, false, null, 0, 8192); if (!is_string($contents)) { throw new \RuntimeException(sprintf('Unable to read component metadata from "%s".', $path)); } $contents = str_replace("\r", "\n", $contents); $headers = []; foreach (['name' => $name, 'version' => 'Version', 'update_uri' => 'Update URI'] as $key => $label) { $headers[$key] = preg_match('/^[ \t\/*#@]*' . preg_quote($label, '/') . ':(.*)$/mi', $contents, $match) ? trim(preg_replace('/\s*(?:\*\/|\?>).*/', '', $match[1])) : ''; } return $headers; } } roots = $roots; $this->factory = $factory; $this->administratorThreshold = $administratorThreshold; $this->adminWhitelist = $adminWhitelist; $this->adminWhitelistPath = $adminWhitelistPath; } public function run(array $report, array $selections) { CLI::writeBreak(); CLI::writeLine('Scanning WordPress databases...', 1, 'cyan'); $targets = []; $findings = []; $errors = []; $seenTargets = []; $roots = $this->selectedRoots($selections); try { $module = call_user_func($this->factory, $this->administratorThreshold, $this->adminWhitelist, $this->adminWhitelistPath); if (!is_object($module) || !method_exists($module, 'scan')) { throw new \RuntimeException('The WordPress database module is unavailable.'); } foreach ($roots as $root) { $result = $module->scan($root['path']); if (!is_array($result) || !isset($result['coverage']) || !is_array($result['coverage'])) { throw new \RuntimeException('The WordPress database module returned an invalid result.'); } $targetId = isset($result['target_id']) ? (string)$result['target_id'] : ''; if ($targetId !== '' && isset($seenTargets[$targetId])) { continue; } $seenTargets[$targetId] = true; $targets[] = $result; $targetFindings = isset($result['findings']) ? (array)$result['findings'] : []; $findings = array_merge($findings, $targetFindings); $report['detected'] += count($targetFindings); foreach (isset($result['coverage']['errors']) ? (array)$result['coverage']['errors'] : [] as $error) { $errors[] = $root['path'] . ': ' . $error; } if (Scanner::$prompt === null && Scanner::isCli() && !empty($result['findings'])) { $prompter = static function (string $question): string { return CLI::read($question, 'purple'); }; $cleanup = Database::interactiveCleanup($result, $prompter); $report['removed'] = array_merge($report['removed'], $cleanup['removed']); $report['whitelist'] = array_merge($report['whitelist'], $cleanup['whitelist'] ?? []); } $this->displayResult($result); } } catch (\Throwable $error) { $errors[] = $error->getMessage(); } if ($targets === [] && $errors === []) { CLI::writeLine('No WordPress installation was found for database scanning.', 1, 'yellow'); } $coverage = ['complete' => $errors === [], 'discovered' => count($roots), 'scanned' => count($targets), 'errors' => $errors]; $report['wordpress_db'] = ['targets' => $targets, 'coverage' => $coverage]; $report['findings'] = $this->mergeFindings($report['findings'], $findings); $report['coverage']['database'] = $coverage; $report['coverage']['errors'] += count($errors); $report['coverage']['complete'] = !empty($report['coverage']['complete']) && $coverage['complete']; return $report; } public function skipped(array $report, array $selections) { $error = 'The WordPress database phase was skipped because the file scan is incomplete.'; $coverage = ['complete' => false, 'discovered' => count($this->selectedRoots($selections)), 'scanned' => 0, 'errors' => [$error]]; $report['wordpress_db'] = ['targets' => [], 'coverage' => $coverage]; $report['coverage']['database'] = $coverage; $report['coverage']['errors']++; CLI::writeLine($error, 1, 'yellow'); return $report; } private function selectedRoots(array $selections) { return array_values(array_filter($this->roots, function ($root) use ($selections) { if (!isset($root['path'])) { return false; } foreach ($selections as $selection) { if ($this->pathsOverlap($root['path'], $selection)) { return true; } } return false; })); } private function pathsOverlap($left, $right) { $left = rtrim(str_replace('\\', '/', (string)$left), '/'); $right = rtrim(str_replace('\\', '/', (string)$right), '/'); if (DIRECTORY_SEPARATOR === '\\') { $left = strtolower($left); $right = strtolower($right); } return $left === $right || strpos($left, $right . '/') === 0 || strpos($right, $left . '/') === 0; } private function displayResult(array $result) { $database = !empty($result['database']) ? $result['database'] : '(unavailable)'; $root = isset($result['root']) ? $result['root'] : ''; CLI::writeLine('WordPress database ' . $database . ' for ' . $root, 1); foreach (isset($result['findings']) ? (array)$result['findings'] : [] as $finding) { $rule = isset($finding['rule_id']) ? $finding['rule_id'] : ''; if ($rule === 'database:trigger') { $trigger = isset($finding['evidence']['trigger']) ? $finding['evidence']['trigger'] : 'unknown'; $table = isset($finding['evidence']['table']) ? $finding['evidence']['table'] : 'unknown'; CLI::writeLine(' Trigger: ' . $trigger . ' on ' . $table, 1, 'red'); } else { CLI::writeLine(' ' . (isset($finding['message']) ? $finding['message'] : $rule), 1, 'yellow'); } } foreach (isset($result['coverage']['errors']) ? (array)$result['coverage']['errors'] : [] as $error) { CLI::writeLine(' Database scan incomplete: ' . $error, 1, 'yellow'); } } private function mergeFindings(array $left, array $right) { $merged = []; foreach (array_merge($left, $right) as $index => $finding) { $id = is_array($finding) && !empty($finding['id']) ? $finding['id'] : '__finding_' . $index; if (!isset($merged[$id])) { $merged[$id] = $finding; } } return array_values($merged); } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\WordPress; use AMWScan\Platform\ProcessApiProviderAbstract; class ProcessApiProvider extends ProcessApiProviderAbstract { private const CLI_TYPE = 'wp-cli'; private const CLI_PROCESS_TYPE = 'wp-cli-process'; private const SSH_TYPE = 'wordpress-ssh'; public function getClassTypes() { return [ 'wp_cli' => self::CLI_TYPE, 'wp_cli\\process' => self::CLI_PROCESS_TYPE, 'wp_filesystem_ssh2' => self::SSH_TYPE, ]; } public function getTypeDetails() { return [ self::CLI_TYPE => [ 'platform' => 'WordPress / WP-CLI', 'api' => 'WP_CLI', 'instanceTerminals' => [], 'staticTerminals' => ['launch', 'launch_self', 'runcommand'], ], self::CLI_PROCESS_TYPE => [ 'platform' => 'WordPress / WP-CLI', 'api' => 'WP-CLI process', 'instanceTerminals' => ['run', 'run_check', 'run_check_stderr'], 'staticTerminals' => [], ], self::SSH_TYPE => [ 'platform' => 'WordPress', 'api' => 'WordPress SSH filesystem', 'instanceTerminals' => ['run_command'], 'staticTerminals' => [], ], ]; } public function getStaticReturnTypes() { return [ self::CLI_PROCESS_TYPE => ['create' => self::CLI_PROCESS_TYPE], ]; } public function allowsStaticTerminalCall($type, $method, array $arguments) { if ($type !== self::CLI_TYPE || $method !== 'runcommand') { return true; } if (count($arguments) === 1) { return true; } if (count($arguments) < 2) { return false; } return preg_match('/[\'\"]launch[\'\"]=>true/i', $arguments[1]) === 1; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\WordPress; class ContentInventory { private const BATCH_SIZE = 50; private const MAX_CONTENT_BYTES = 1048576; private const MAX_RECORDS = 5000; private const MAX_TOTAL_BYTES = 33554432; private $coverage = []; private $database; public function __construct($database = null) { $this->database = $database !== null ? $database : (isset($GLOBALS['wpdb']) ? $GLOBALS['wpdb'] : null); } public function supports($root) { return $this->database !== null && method_exists($this->database, 'prepare') && method_exists($this->database, 'get_results') && Verifier::isRoot($root); } public function collect($root) { $this->coverage = ['complete' => true, 'discovered' => 0, 'collected' => 0, 'skipped' => 0, 'bytes' => 0]; if (!$this->supports($root)) { return []; } $sources = [ 'posts' => [$this->database->posts, 'ID', 'post_title', 'post_content', "post_type NOT IN ('revision', 'nav_menu_item')"], 'comments' => [$this->database->comments, 'comment_ID', 'comment_author', 'comment_content', "comment_approved <> 'trash'"], 'options' => [$this->database->options, 'option_id', 'option_name', 'option_value', "option_name NOT LIKE '\\_transient\\_%'"], ]; $records = []; $remainingBytes = self::MAX_TOTAL_BYTES; foreach ($sources as $kind => $source) { foreach ($this->collectSource($kind, $source, $remainingBytes) as $record) { $records[] = $record; if (count($records) >= self::MAX_RECORDS || $remainingBytes <= 0) { $this->coverage['complete'] = false; break 2; } } } usort($records, static function (array $left, array $right) { return strcmp($left['subject'], $right['subject']); }); return $records; } public function getCoverage() { return $this->coverage; } private function collectSource($kind, array $source, &$remainingBytes) { list($table, $idColumn, $titleColumn, $contentColumn, $condition) = $source; foreach ([$table, $idColumn, $titleColumn, $contentColumn] as $identifier) { if (!is_string($identifier) || !preg_match('/^[a-zA-Z0-9_]+$/', $identifier)) { throw new \RuntimeException('Database inventory contains an unsafe identifier.'); } } $records = []; $cursor = 0; while (count($records) < self::MAX_RECORDS) { $query = $this->database->prepare( "SELECT {$idColumn} AS id, {$titleColumn} AS title, LEFT({$contentColumn}, " . (self::MAX_CONTENT_BYTES + 1) . ") AS content FROM {$table} WHERE {$idColumn} > %d AND {$condition} " . "ORDER BY {$idColumn} ASC LIMIT %d", $cursor, self::BATCH_SIZE ); $rows = $this->database->get_results($query, defined('ARRAY_A') ? ARRAY_A : 'ARRAY_A'); if (!is_array($rows)) { $this->coverage['complete'] = false; break; } if (empty($rows)) { break; } foreach ($rows as $row) { if (!is_array($row) || !isset($row['id'], $row['content']) || !is_scalar($row['content'])) { $this->coverage['complete'] = false; $this->coverage['skipped']++; continue; } $this->coverage['discovered']++; $cursor = max($cursor, (int)$row['id']); $content = (string)$row['content']; $contentBytes = strlen($content); if ($contentBytes > self::MAX_CONTENT_BYTES || $contentBytes > $remainingBytes) { $this->coverage['complete'] = false; $this->coverage['skipped']++; continue; } $remainingBytes -= $contentBytes; $this->coverage['collected']++; $this->coverage['bytes'] += $contentBytes; $records[] = [ 'subject' => 'wordpress-db:' . $kind . ':' . (int)$row['id'], 'kind' => $kind, 'title' => isset($row['title']) && is_scalar($row['title']) ? (string)$row['title'] : '', 'content' => $content, ]; if ($remainingBytes <= 0) { $this->coverage['complete'] = false; break 2; } } if (count($rows) < self::BATCH_SIZE) { break; } } return $records; } } data = $data; } public function html() { $report = $this->databaseReport(); if (empty($report)) { return ''; } $content = '

WordPress database scan

'; $content .= $this->errorsHtml($report); $targets = (array)($report['targets'] ?? []); if (empty($targets)) { return $content . '

No WordPress database target was discovered.

'; } foreach ($targets as $target) { $content .= $this->targetHtml($target); } return $content . ''; } public function text() { $report = $this->databaseReport(); if (empty($report)) { return ''; } $lines = array_merge(['', '', 'WordPress database scan', str_repeat('=', 40)], $this->errorLines($report)); foreach ((array)($report['targets'] ?? []) as $target) { $lines = array_merge($lines, $this->targetLines($target)); } return implode(PHP_EOL, $lines); } private function databaseReport() { return isset($this->data['wordpressDatabase']) && is_array($this->data['wordpressDatabase']) ? $this->data['wordpressDatabase'] : []; } private function databaseName($target) { return isset($target['database']) && $target['database'] !== '' ? $target['database'] : '(unavailable)'; } private function errorsHtml($report) { $content = ''; foreach ((array)($report['coverage']['errors'] ?? []) as $error) { $content .= '
' . $this->escape($error) . '
'; } return $content; } private function targetHtml($target) { $content = '

' . $this->escape($this->databaseName($target)) . '

' . $this->escape($target['root'] ?? '') . '

'; foreach ((array)($target['findings'] ?? []) as $finding) { $content .= $this->findingHtml($finding); } return $content . $this->errorsHtml($target) . '
'; } private function findingHtml($finding) { $evidence = isset($finding['evidence']) && is_array($finding['evidence']) ? $finding['evidence'] : []; $encoded = json_encode($evidence, JSON_UNESCAPED_SLASHES | JSON_INVALID_UTF8_SUBSTITUTE); return '
' . $this->escape($finding['rule_id'] ?? 'database:finding') . '

' . $this->escape($finding['message'] ?? '') . '

'
            . $this->escape($encoded ?: '{}') . '
'; } private function errorLines($report) { $lines = []; foreach ((array)($report['coverage']['errors'] ?? []) as $error) { $lines[] = '- Incomplete: ' . $error; } return $lines; } private function targetLines($target) { $lines = [$this->databaseName($target) . ' for ' . ($target['root'] ?? '')]; foreach ((array)($target['findings'] ?? []) as $finding) { $lines = array_merge($lines, $this->findingLines($finding)); } return array_merge($lines, $this->errorLines($target)); } private function findingLines($finding) { $lines = ['- ' . ($finding['rule_id'] ?? 'database:finding') . ': ' . ($finding['message'] ?? '')]; foreach ((array)($finding['evidence'] ?? []) as $key => $value) { $encoded = is_scalar($value) ? (string)$value : json_encode($value, JSON_UNESCAPED_SLASHES | JSON_INVALID_UTF8_SUBSTITUTE); $lines[] = ' ' . $key . ': ' . ($encoded === false ? '' : $encoded); } return $lines; } private function escape($value) { return htmlentities((string)$value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'); } } request = $request ?: [self::class, 'request']; } public function enrich(array $components, $online = false) { foreach ($components as &$component) { if (!is_array($component) || !in_array($component['ecosystem'] ?? '', ['wordpress-core', 'wordpress-plugin', 'wordpress-theme'], true)) { continue; } $component['latest_version'] = null; $component['update_available'] = null; if (!$online || !$this->validVersion($component['version'] ?? null)) { continue; } $url = $this->url($component); if ($url === null) { continue; } $cache = Cache::getInstance(); $key = 'wordpress_update_v1_' . hash('sha256', $url); $latest = $cache->get($key); if ($latest === null) { try { $data = call_user_func($this->request, $url); $latest = $component['ecosystem'] === 'wordpress-core' ? ($data['offers'][0]['version'] ?? null) : ($data['version'] ?? null); } catch (\Throwable $error) { $latest = null; } $latest = $this->validVersion($latest) ? $latest : false; $cache->set($key, $latest, $latest === false ? 300 : 3600); } if ($this->validVersion($latest)) { $component['latest_version'] = $latest; $component['update_available'] = version_compare($component['version'], $latest, '<'); } } unset($component); return $components; } private function validVersion($version) { return is_string($version) && preg_match('/^\d[0-9a-zA-Z.+_-]{0,63}$/D', $version) === 1; } private function url(array $component) { if ($component['ecosystem'] === 'wordpress-core') { return 'https://api.wordpress.org/core/version-check/1.7/'; } // A custom update provider must never be mistaken for a wordpress.org package. if (!empty($component['update_uri'])) { return null; } $slug = $component['package'] ?? ''; if (!is_string($slug) || preg_match('/^[a-z0-9][a-z0-9_-]{0,199}$/D', $slug) !== 1) { return null; } $type = $component['ecosystem'] === 'wordpress-plugin' ? 'plugin' : 'theme'; return 'https://api.wordpress.org/' . $type . 's/info/1.2/?action=' . $type . '_information&slug=' . urlencode($slug) . '&fields=version'; } public static function request($url) { $context = stream_context_create(['http' => [ 'timeout' => 5, 'follow_location' => 0, 'header' => "Accept: application/json\r\n", ]]); $content = @file_get_contents($url, false, $context, 0, 1048577); if (!is_string($content) || strlen($content) > 1048576) { return null; } $data = json_decode($content, true); return is_array($data) ? $data : null; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\WordPress; use AMWScan\Console\CLI; use AMWScan\Filesystem\Path; use AMWScan\Findings\Finding; use AMWScan\Remediation\Actions; use AMWScan\Scan\Whitelist; class Database { public const MAX_NORMAL_ADMINISTRATOR_THRESHOLD = 1; private const MAX_ADMINISTRATOR_INSPECTION = 100; private const MAX_ADMINISTRATOR_SAMPLE = 20; private const MAX_CONFIG_BYTES = 1048576; private const MAX_DELETE_BATCH = 100; private const MAX_ORPHAN_SAMPLE = 20; private const MAX_STATEMENT_LENGTH = 2000; private const MAX_TEXT_LENGTH = 500; private const MAX_TRIGGER_FINDINGS = 100; private $connector; private $administratorThreshold; private $adminWhitelist; private $adminWhitelistPath; private $targetResults = []; public function __construct(?callable $connector = null, $administratorThreshold = self::MAX_NORMAL_ADMINISTRATOR_THRESHOLD, array $adminWhitelist = [], $adminWhitelistPath = '') { if ((!is_int($administratorThreshold) && !is_string($administratorThreshold)) || filter_var($administratorThreshold, FILTER_VALIDATE_INT, ['options' => ['min_range' => 1]]) === false) { throw new \InvalidArgumentException('The WordPress administrator threshold must be a positive integer.'); } $this->administratorThreshold = (int)$administratorThreshold; $this->adminWhitelist = $adminWhitelist; $this->adminWhitelistPath = $adminWhitelistPath; $this->connector = $connector ?: function (array $credentials) { return $this->connect($credentials); }; } public function scan($root) { $root = realpath((string)$root); if ($root === false || !is_dir($root)) { return $this->failedResult((string)$root, 'configuration', 'The WordPress root is unavailable.'); } try { $credentials = $this->readConfiguration($root); } catch (\Throwable $error) { return $this->failedResult($root, 'configuration', $error->getMessage()); } $targetId = $this->targetId($credentials); if (isset($this->targetResults[$targetId])) { return array_merge($this->targetResults[$targetId], ['root' => $root]); } $connection = null; try { $connection = call_user_func($this->connector, $credentials); if (!$this->isConnection($connection)) { throw new \RuntimeException('The database connector returned an invalid connection.'); } $result = $this->inspect($root, $credentials, $connection, $targetId); $this->targetResults[$targetId] = $result; return $result; } catch (\Throwable $error) { return $this->failedResult($root, 'connection', $error->getMessage(), $credentials); } finally { if (is_object($connection) && method_exists($connection, 'close')) { $connection->close(); } } } private function inspect($root, array $credentials, $connection, $targetId) { $triggers = $this->inspectTriggers($connection, $credentials['database'], $credentials['prefix'], $targetId); $administrators = $this->inspectAdministrators($connection, $credentials['prefix'], $targetId); $orphans = $this->inspectOrphanedPosts($connection, $credentials['prefix'], $targetId); $errors = array_merge($triggers['errors'], $administrators['errors'], $orphans['errors']); return [ 'root' => $root, 'database' => $credentials['database'], 'prefix' => $credentials['prefix'], 'target_id' => $targetId, 'findings' => array_merge($triggers['findings'], $administrators['findings'], $orphans['findings']), 'inventory' => [ 'administrator_count' => $administrators['count'], 'administrators' => $administrators['administrators'], ], 'coverage' => [ 'complete' => empty($errors), 'checks' => [ 'triggers' => $triggers['coverage'], 'administrators' => $administrators['coverage'], 'orphaned_posts' => $orphans['coverage'], ], 'errors' => $errors, ], 'raw_triggers' => $triggers['raw'] ?? [], 'suspicious_administrators' => $administrators['suspicious'] ?? [], 'orphaned_post_count' => $orphans['coverage']['count'] ?? 0, 'admin_whitelist_path' => $this->adminWhitelistPath, ]; } private function targetId(array $credentials) { return hash('sha256', implode("\0", [ $credentials['host'], $credentials['database'], $credentials['prefix'], ])); } private function inspectTriggers($connection, $database, $prefix, $targetId) { try { $hasTriggerPrivilege = $this->hasTriggerPrivilege($connection, $database); $tablePrefix = $this->value($connection, $prefix); $query = 'SELECT `TRIGGER_NAME` AS `Trigger`, `EVENT_MANIPULATION` AS `Event`, ' . '`EVENT_OBJECT_TABLE` AS `Table`, `ACTION_TIMING` AS `Timing`, `ACTION_STATEMENT` AS `Statement` ' . 'FROM information_schema.TRIGGERS WHERE `TRIGGER_SCHEMA` = DATABASE() ' . 'AND LEFT(`EVENT_OBJECT_TABLE`, ' . strlen($prefix) . ") = '{$tablePrefix}' " . 'ORDER BY `TRIGGER_NAME` ASC LIMIT ' . (self::MAX_TRIGGER_FINDINGS + 1); $rows = $this->rows($connection, $query); $findings = []; $rawTriggers = []; $truncated = count($rows) > self::MAX_TRIGGER_FINDINGS; foreach (array_slice($rows, 0, self::MAX_TRIGGER_FINDINGS) as $row) { $trigger = $this->text(isset($row['Trigger']) ? $row['Trigger'] : 'unknown', self::MAX_TEXT_LENGTH); $table = $this->text($row['Table'], self::MAX_TEXT_LENGTH); $statement = $this->triggerStatement(isset($row['Statement']) ? $row['Statement'] : ''); $findings[] = Finding::create( 'database', 'wordpress-db:' . $targetId . ':trigger:' . hash('sha256', $table . "\0" . $trigger), 'database:trigger', 'medium', 'A database trigger is attached to a WordPress table. Verify that it was created by a trusted component.', [ 'trigger' => $trigger, 'table' => $table, 'event' => $this->text(isset($row['Event']) ? $row['Event'] : '', self::MAX_TEXT_LENGTH), 'timing' => $this->text(isset($row['Timing']) ? $row['Timing'] : '', self::MAX_TEXT_LENGTH), 'statement' => $statement['preview'], 'statement_sha256' => $statement['sha256'], ], 'wordpress-database' ); $rawTriggers[] = [ 'trigger' => $trigger, 'table' => $table, 'event' => $this->text(isset($row['Event']) ? $row['Event'] : '', self::MAX_TEXT_LENGTH), 'timing' => $this->text(isset($row['Timing']) ? $row['Timing'] : '', self::MAX_TEXT_LENGTH), 'statement' => isset($row['Statement']) ? $row['Statement'] : '', ]; } return [ 'findings' => $findings, 'coverage' => [ 'complete' => $hasTriggerPrivilege && !$truncated, 'inspected' => min(count($rows), self::MAX_TRIGGER_FINDINGS), 'reported' => count($findings), 'truncated' => $truncated, ], 'errors' => array_values(array_filter([ $hasTriggerPrivilege ? null : 'The current database user does not expose a verifiable TRIGGER privilege; trigger coverage is incomplete.', $truncated ? 'More than ' . self::MAX_TRIGGER_FINDINGS . ' WordPress table triggers exist; trigger evidence was truncated.' : null, ])), 'raw' => $rawTriggers, ]; } catch (\Throwable $error) { return $this->failedCheck($error->getMessage()); } } private function inspectAdministrators($connection, $prefix, $targetId) { try { $users = $this->identifier($prefix . 'users'); $usermeta = $this->identifier($prefix . 'usermeta'); $capabilityKey = $this->value($connection, $prefix . 'capabilities'); $rolePattern = $this->value($connection, '%"administrator";b:1%'); $from = " FROM {$users} AS `u` INNER JOIN {$usermeta} AS `m` ON `m`.`user_id` = `u`.`ID`" . " WHERE `m`.`meta_key` = '{$capabilityKey}' AND `m`.`meta_value` LIKE '{$rolePattern}'"; // Apply the same scoped identity exclusions before counting and before the bounded sample. foreach ($this->adminWhitelist as $entry) { if (!is_array($entry) || ($entry['target_id'] ?? null) !== $targetId) { continue; } try { $entry = Whitelist::wpAdminEntry($targetId, $entry); } catch (\InvalidArgumentException $error) { continue; } $login = $this->value($connection, $entry['login']); $email = $this->value($connection, $entry['email']); $from .= ' AND NOT (`u`.`ID` = ' . $entry['id'] . " AND BINARY `u`.`user_login` = '{$login}' AND BINARY `u`.`user_email` = '{$email}')"; } $count = max(0, $this->scalar($connection, 'SELECT COUNT(DISTINCT `u`.`ID`) AS `total`' . $from)); $inspected = []; if ($count > 0) { $query = 'SELECT `u`.`ID`, `u`.`user_login`, `u`.`user_email`, `u`.`user_url`, `u`.`user_registered`' . $from . ' GROUP BY `u`.`ID`, `u`.`user_login`, `u`.`user_email`, `u`.`user_url`, `u`.`user_registered`' . ' ORDER BY `u`.`ID` ASC LIMIT ' . (self::MAX_ADMINISTRATOR_INSPECTION + 1); foreach ($this->rows($connection, $query) as $row) { $inspected[] = $this->administratorRecord($row); } } $nonWhitelistedCount = $count; $truncated = $count > self::MAX_ADMINISTRATOR_INSPECTION || count($inspected) > self::MAX_ADMINISTRATOR_INSPECTION || count($inspected) < $count; $nonWhitelisted = array_slice($inspected, 0, self::MAX_ADMINISTRATOR_INSPECTION); $administrators = array_slice($nonWhitelisted, 0, self::MAX_ADMINISTRATOR_SAMPLE); $findings = []; $suspiciousAdmins = []; if ($nonWhitelistedCount > $this->administratorThreshold) { $findings[] = Finding::create( 'database', 'wordpress-db:' . $targetId . ':administrators', 'database:multiple-administrators', 'low', sprintf('%d administrator accounts can access this WordPress site. Verify that every account is expected.', $nonWhitelistedCount), [ 'count' => $nonWhitelistedCount, 'threshold' => $this->administratorThreshold, 'sample' => $administrators, 'truncated' => $nonWhitelistedCount > count($administrators), ], 'wordpress-database' ); } foreach ($nonWhitelisted as $row) { $finding = $this->suspiciousAdministratorFinding($row, $targetId); if ($finding !== null) { $findings[] = $finding; $suspiciousAdmins[] = $row; } } $errors = $truncated ? ['Administrator inspection is incomplete; at most ' . self::MAX_ADMINISTRATOR_INSPECTION . ' non-whitelisted accounts are inspected.'] : []; return [ 'findings' => $findings, 'count' => $nonWhitelistedCount, 'administrators' => $administrators, 'coverage' => [ 'complete' => !$truncated, 'count' => $nonWhitelistedCount, 'sampled' => count($administrators), 'inspected' => count($nonWhitelisted), 'truncated' => $truncated, ], 'errors' => $errors, 'suspicious' => $suspiciousAdmins, ]; } catch (\Throwable $error) { return array_merge($this->failedCheck($error->getMessage()), [ 'count' => 0, 'administrators' => [], ]); } } private function inspectOrphanedPosts($connection, $prefix, $targetId) { try { $posts = $this->identifier($prefix . 'posts'); $users = $this->identifier($prefix . 'users'); $from = " FROM {$posts} AS `p` LEFT JOIN {$users} AS `u` ON `u`.`ID` = `p`.`post_author`" . ' WHERE `p`.`post_author` <> 0 AND `u`.`ID` IS NULL'; $count = max(0, $this->scalar($connection, 'SELECT COUNT(*) AS `total`' . $from)); if ($count === 0) { return [ 'findings' => [], 'coverage' => ['complete' => true, 'count' => 0, 'sampled' => 0, 'truncated' => false], 'errors' => [], ]; } $query = 'SELECT `p`.`ID`, `p`.`post_title`, `p`.`post_author`, `p`.`post_type`, `p`.`post_status`, `p`.`post_date`' . $from . ' ORDER BY `p`.`ID` DESC LIMIT ' . self::MAX_ORPHAN_SAMPLE; $sample = []; foreach ($this->rows($connection, $query) as $row) { $sample[] = $this->orphanRecord($row); } return [ 'findings' => [Finding::create( 'database', 'wordpress-db:' . $targetId . ':orphaned-posts', 'database:orphaned-posts', 'medium', sprintf('%d posts reference author accounts that no longer exist. Review them for injected or abandoned content.', $count), [ 'count' => $count, 'sample' => $sample, 'truncated' => $count > count($sample), ], 'wordpress-database' )], 'coverage' => [ 'complete' => true, 'count' => $count, 'sampled' => count($sample), 'truncated' => $count > count($sample), ], 'errors' => [], ]; } catch (\Throwable $error) { return $this->failedCheck($error->getMessage()); } } private function readConfiguration($root) { $path = $this->configurationPath($root); if ($path === null) { throw new \RuntimeException('No readable wp-config.php was found for the WordPress root.'); } $size = filesize($path); if ($size === false || $size > self::MAX_CONFIG_BYTES) { throw new \RuntimeException('wp-config.php exceeds the safe parsing limit.'); } $contents = file_get_contents($path); if (!is_string($contents)) { throw new \RuntimeException('wp-config.php could not be read.'); } return $this->parseConfiguration($contents); } private function configurationPath($root) { $candidates = [$root . DIRECTORY_SEPARATOR . 'wp-config.php']; $parent = dirname($root); if (!is_file($parent . DIRECTORY_SEPARATOR . 'wp-settings.php')) { $candidates[] = $parent . DIRECTORY_SEPARATOR . 'wp-config.php'; } foreach ($candidates as $candidate) { if (is_file($candidate) && !is_link($candidate) && is_readable($candidate)) { return $candidate; } } return null; } private function parseConfiguration($contents) { $tokens = token_get_all($contents); $values = []; $prefix = null; $prefixSeen = false; $ambiguous = false; $braceDepth = 0; $alternativeDepth = 0; $pendingAlternativeControl = false; $requiredNames = ['DB_NAME', 'DB_USER', 'DB_PASSWORD', 'DB_HOST']; foreach ($tokens as $index => $token) { if (is_array($token) && in_array($token[0], [T_ENDIF, T_ENDFOR, T_ENDFOREACH, T_ENDWHILE, T_ENDSWITCH], true)) { $alternativeDepth = max(0, $alternativeDepth - 1); continue; } if (is_array($token) && in_array($token[0], [T_IF, T_FOR, T_FOREACH, T_WHILE, T_SWITCH], true)) { $pendingAlternativeControl = true; } if ($token === '{') { $braceDepth++; $pendingAlternativeControl = false; continue; } if ($token === '}') { $braceDepth = max(0, $braceDepth - 1); continue; } if ($token === ':' && $pendingAlternativeControl) { $alternativeDepth++; $pendingAlternativeControl = false; continue; } if ($token === ';' && $pendingAlternativeControl) { $pendingAlternativeControl = false; } if (is_array($token) && $token[0] === T_STRING && strtolower($token[1]) === 'define') { $name = $this->literalDefineName($tokens, $index); if (!in_array($name, $requiredNames, true)) { continue; } $definition = $this->literalDefine($tokens, $index); if ($braceDepth !== 0 || $alternativeDepth !== 0 || !$this->isStandaloneConfigurationStatement($tokens, $index) || $definition === null || array_key_exists($name, $values)) { $ambiguous = true; } else { $values[$definition[0]] = $definition[1]; } } if (is_array($token) && $token[0] === T_VARIABLE && $token[1] === '$table_prefix') { $literal = $this->literalAssignment($tokens, $index); if ($braceDepth !== 0 || $alternativeDepth !== 0 || !$this->isStandaloneConfigurationStatement($tokens, $index) || $prefixSeen || $literal === null) { $ambiguous = true; } else { $prefix = $literal; } $prefixSeen = true; } } if ($ambiguous) { throw new \RuntimeException('wp-config.php must contain one unambiguous literal value for each database setting.'); } foreach ($requiredNames as $name) { if (!array_key_exists($name, $values)) { throw new \RuntimeException('wp-config.php must define ' . $name . ' as a literal string.'); } } if ($prefix === null || !$this->isIdentifierPart($prefix)) { throw new \RuntimeException('wp-config.php must assign a safe literal table prefix.'); } foreach (['DB_NAME', 'DB_USER', 'DB_HOST'] as $name) { if (trim($values[$name]) === '') { throw new \RuntimeException('wp-config.php must define ' . $name . ' as a non-empty literal string.'); } } return [ 'database' => $values['DB_NAME'], 'user' => $values['DB_USER'], 'password' => $values['DB_PASSWORD'], 'host' => $values['DB_HOST'], 'prefix' => $prefix, ]; } private function literalDefine(array $tokens, $index) { $open = $this->nextToken($tokens, $index + 1); $name = $open !== null ? $this->nextToken($tokens, $open + 1) : null; $comma = $name !== null ? $this->nextToken($tokens, $name + 1) : null; $value = $comma !== null ? $this->nextToken($tokens, $comma + 1) : null; $close = $value !== null ? $this->nextToken($tokens, $value + 1) : null; if ($open === null || $tokens[$open] !== '(' || $name === null || !$this->isStringToken($tokens[$name]) || $comma === null || $tokens[$comma] !== ',' || $value === null || !$this->isStringToken($tokens[$value]) || $close === null || $tokens[$close] !== ')') { return null; } return [$this->decodeString($tokens[$name][1]), $this->decodeString($tokens[$value][1])]; } private function literalDefineName(array $tokens, $index) { $open = $this->nextToken($tokens, $index + 1); $name = $open !== null ? $this->nextToken($tokens, $open + 1) : null; if ($open === null || $tokens[$open] !== '(' || $name === null || !$this->isStringToken($tokens[$name])) { return null; } return $this->decodeString($tokens[$name][1]); } private function literalAssignment(array $tokens, $index) { $equals = $this->nextToken($tokens, $index + 1); $value = $equals !== null ? $this->nextToken($tokens, $equals + 1) : null; $end = $value !== null ? $this->nextToken($tokens, $value + 1) : null; if ($equals === null || $tokens[$equals] !== '=' || $value === null || !$this->isStringToken($tokens[$value]) || $end === null || $tokens[$end] !== ';') { return null; } return $this->decodeString($tokens[$value][1]); } private function nextToken(array $tokens, $index) { $count = count($tokens); for (; $index < $count; $index++) { $token = $tokens[$index]; if (is_array($token) && in_array($token[0], [T_WHITESPACE, T_COMMENT, T_DOC_COMMENT], true)) { continue; } return $index; } return null; } private function isStandaloneConfigurationStatement(array $tokens, $index) { $previous = $this->previousToken($tokens, $index - 1); if ($previous === null) { return true; } $token = $tokens[$previous]; return $token === ';' || $token === '}' || (is_array($token) && in_array($token[0], [T_OPEN_TAG, T_OPEN_TAG_WITH_ECHO], true)); } private function previousToken(array $tokens, $index) { for (; $index >= 0; $index--) { $token = $tokens[$index]; if (is_array($token) && in_array($token[0], [T_WHITESPACE, T_COMMENT, T_DOC_COMMENT], true)) { continue; } return $index; } return null; } private function isStringToken($token) { return is_array($token) && $token[0] === T_CONSTANT_ENCAPSED_STRING; } private function decodeString($literal) { $quote = substr($literal, 0, 1); $value = substr($literal, 1, -1); if ($quote === "'") { return str_replace(['\\\\', "\\'"], ['\\', "'"], $value); } return stripcslashes($value); } private function connect(array $credentials) { if (!function_exists('mysqli_init')) { throw new \RuntimeException('The mysqli extension is required for WordPress database scanning.'); } $connection = mysqli_init(); if (!$connection) { throw new \RuntimeException('The mysqli connection could not be initialized.'); } $parameters = $this->connectionParameters($credentials['host']); try { if (defined('MYSQLI_OPT_CONNECT_TIMEOUT')) { $connection->options(MYSQLI_OPT_CONNECT_TIMEOUT, 5); } $connected = @$connection->real_connect( $parameters['host'], $credentials['user'], $credentials['password'], $credentials['database'], $parameters['port'], $parameters['socket'] ); } catch (\Throwable $error) { $code = (int)$error->getCode(); $connection->close(); throw new \RuntimeException('WordPress database connection failed (error ' . $code . ').'); } if (!$connected) { $error = (int)$connection->connect_errno; $connection->close(); throw new \RuntimeException('WordPress database connection failed (error ' . $error . ').'); } return $connection; } private function connectionParameters($value) { $value = trim((string)$value); $host = $value; $port = null; $socket = null; if (preg_match('/^\[([^]]+)\](?::([0-9]+))?$/', $value, $match)) { $host = $match[1]; $port = isset($match[2]) && $match[2] !== '' ? (int)$match[2] : null; } elseif (preg_match('/^([^:]+):([0-9]+)$/', $value, $match)) { $host = $match[1]; $port = (int)$match[2]; } elseif (preg_match('~^([^:]+):([/\\\\].+)$~', $value, $match)) { $host = $match[1]; $socket = $match[2]; } if ($port !== null && ($port < 1 || $port > 65535)) { throw new \RuntimeException('wp-config.php contains an invalid DB_HOST port.'); } return ['host' => $host, 'port' => $port, 'socket' => $socket]; } private function rows($connection, $query) { $result = $connection->query($query); if (!is_object($result) || !method_exists($result, 'fetch_assoc')) { throw new \RuntimeException('WordPress database query failed (error ' . $this->errorNumber($connection) . ').'); } $rows = []; try { while (true) { $row = $result->fetch_assoc(); if ($row === null) { break; } if ($row === false || !is_array($row)) { throw new \RuntimeException('WordPress database result fetching failed.'); } $rows[] = $row; } } finally { if (method_exists($result, 'free')) { $result->free(); } } return $rows; } private function hasTriggerPrivilege($connection, $database) { $grants = $this->rows($connection, 'SHOW GRANTS FOR CURRENT_USER'); $database = preg_quote($database, '/'); $scope = '(?:\*\.\*|`?' . $database . '`?\.\*)'; foreach ($grants as $grant) { $statement = implode(' ', array_map('strval', $grant)); if (preg_match('/\bGRANT\b.*\b(?:ALL PRIVILEGES|TRIGGER)\b.*\bON\s+' . $scope . '\s+TO\b/i', $statement)) { return true; } } return false; } private function scalar($connection, $query) { $rows = $this->rows($connection, $query); if (empty($rows[0])) { throw new \RuntimeException('WordPress database aggregate query returned no result.'); } return (int)reset($rows[0]); } private function value($connection, $value) { return $connection->real_escape_string((string)$value); } private function identifier($value) { if (!$this->isIdentifierPart($value)) { throw new \RuntimeException('WordPress database table prefix is unsafe.'); } return '`' . $value . '`'; } private function isIdentifierPart($value) { return is_string($value) && preg_match('/^[A-Za-z0-9_]+$/', $value) === 1; } private function isConnection($connection) { return is_object($connection) && method_exists($connection, 'query') && method_exists($connection, 'real_escape_string'); } private function errorNumber($connection) { return isset($connection->errno) ? (int)$connection->errno : 0; } private function administratorRecord(array $row) { return [ 'id' => isset($row['ID']) ? (int)$row['ID'] : 0, 'login' => $this->text(isset($row['user_login']) ? $row['user_login'] : '', self::MAX_TEXT_LENGTH), 'email' => $this->text(isset($row['user_email']) ? $row['user_email'] : '', self::MAX_TEXT_LENGTH), 'url' => $this->text(isset($row['user_url']) ? $row['user_url'] : '', self::MAX_TEXT_LENGTH), 'registered_at' => $this->text(isset($row['user_registered']) ? $row['user_registered'] : '', self::MAX_TEXT_LENGTH), ]; } private function suspiciousAdministratorFinding(array $row, string $targetId): ?array { $userUrl = isset($row['url']) ? (string)$row['url'] : ''; $userEmail = isset($row['email']) ? (string)$row['email'] : ''; $userLogin = isset($row['login']) ? (string)$row['login'] : ''; $userRegistered = isset($row['registered_at']) ? (string)$row['registered_at'] : ''; $reasons = $this->suspiciousAdministratorReasons($userUrl, $userEmail, $userLogin, $userRegistered); if ($reasons === []) { return null; } return Finding::create( 'database', 'wordpress-db:' . $targetId . ':administrator:' . (isset($row['id']) ? (int)$row['id'] : 0), 'database:suspicious-administrator', 'medium', 'A WordPress administrator account matched suspicious indicators: ' . implode('; ', $reasons), [ 'id' => isset($row['id']) ? (int)$row['id'] : 0, 'login' => $this->text($userLogin, self::MAX_TEXT_LENGTH), 'email' => $this->text($userEmail, self::MAX_TEXT_LENGTH), 'url' => $this->text($userUrl, self::MAX_TEXT_LENGTH), 'registered_at' => $this->text($userRegistered, self::MAX_TEXT_LENGTH), 'reasons' => $reasons, ], 'wordpress-database' ); } private function suspiciousAdministratorReasons($userUrl, $userEmail, $userLogin, $userRegistered) { $patterns = ['https://wordpress.com', '@wordpress.org']; foreach ($patterns as $pattern) { if ($userUrl !== '' && stripos($userUrl, $pattern) !== false) { return ['Suspicious user_url: ' . $userUrl]; } } foreach ($patterns as $pattern) { if ($userEmail !== '' && stripos($userEmail, $pattern) !== false) { return ['Suspicious user_email: ' . $userEmail]; } if ($userLogin !== '' && stripos($userLogin, $pattern) !== false) { return ['Suspicious user_login: ' . $userLogin]; } } if ($userRegistered !== '' && $userRegistered < '2003-01-01 00:00:00') { return ['User ' . $userLogin . ' registered before 2003: ' . $userRegistered]; } return []; } private function orphanRecord(array $row) { return [ 'id' => isset($row['ID']) ? (int)$row['ID'] : 0, 'title' => $this->text(isset($row['post_title']) ? $row['post_title'] : '', self::MAX_TEXT_LENGTH), 'author_id' => isset($row['post_author']) ? (int)$row['post_author'] : 0, 'type' => $this->text(isset($row['post_type']) ? $row['post_type'] : '', self::MAX_TEXT_LENGTH), 'status' => $this->text(isset($row['post_status']) ? $row['post_status'] : '', self::MAX_TEXT_LENGTH), 'published_at' => $this->text(isset($row['post_date']) ? $row['post_date'] : '', self::MAX_TEXT_LENGTH), ]; } private function failedResult($root, $check, $message, array $credentials = []) { return [ 'root' => $root, 'database' => isset($credentials['database']) ? $credentials['database'] : '', 'prefix' => isset($credentials['prefix']) ? $credentials['prefix'] : '', 'target_id' => '', 'findings' => [], 'inventory' => ['administrator_count' => 0, 'administrators' => []], 'coverage' => [ 'complete' => false, 'checks' => [$check => ['complete' => false]], 'errors' => [(string)$message], ], ]; } private function failedCheck($message) { return [ 'findings' => [], 'coverage' => ['complete' => false], 'errors' => [(string)$message], ]; } private function triggerStatement($value) { $value = (string)$value; $preview = substr($value, 0, self::MAX_STATEMENT_LENGTH * 4); $preview = preg_replace_callback( '/\'(?:\\\\.|\'\'|[^\'])*\'|"(?:\\\\.|""|[^"])*"/s', static function ($match) { $quote = substr($match[0], 0, 1); return $quote . '[redacted]' . $quote; }, $preview ); return [ 'preview' => $this->text(is_string($preview) ? $preview : '', self::MAX_STATEMENT_LENGTH), 'sha256' => hash('sha256', $value), ]; } private function text($value, $limit) { $value = preg_replace('/[\x00-\x1F\x7F]+/', ' ', (string)$value); if (!is_string($value)) { return ''; } return strlen($value) <= $limit ? $value : substr($value, 0, $limit); } public static function getCredentials($root) { $database = new self(); return $database->readConfiguration($root); } public static function remediateFinding($root, array $finding, $reassignUserId = 0) { $database = new self(); $connection = null; try { $credentials = $database->readConfiguration($root); $connection = $database->connect($credentials); $rule = (string)($finding['rule_id'] ?? ''); if ($rule === 'database:trigger') { $result = self::deleteTrigger($connection, $finding['evidence']['trigger'] ?? ''); } elseif ($rule === 'database:suspicious-administrator') { $result = self::deleteUser( $connection, $credentials['prefix'], (int)($finding['evidence']['id'] ?? 0), (int)$reassignUserId ); } elseif ($rule === 'database:orphaned-posts') { $deleted = 0; do { $ids = self::orphanedPostIds($connection, $credentials['prefix']); if ($ids === []) { break; } $batch = self::deleteOrphanedPosts($connection, $credentials['prefix'], $ids); $deleted += $batch['success']; if ($batch['failed'] > 0 || $batch['success'] === 0) { throw new \RuntimeException('Some orphaned posts could not be removed.'); } } while (count($ids) === self::MAX_DELETE_BATCH); $result = $deleted; } else { throw new \InvalidArgumentException('The finding cannot be remediated.'); } if ($result === false) { throw new \RuntimeException('The database finding could not be remediated safely.'); } return $result; } finally { if (is_object($connection) && method_exists($connection, 'close')) { $connection->close(); } } } public static function deleteTrigger($mysqli, $triggerName) { try { $identifier = self::quotedIdentifier($triggerName); } catch (\Throwable $error) { return false; } return $mysqli->query('DROP TRIGGER IF EXISTS ' . $identifier) !== false ? (string)$triggerName : false; } public static function deleteUser($mysqli, $prefix = 'wp_', $userId = 0, $reassignUserId = 0) { $userId = (int)$userId; $reassignUserId = (int)$reassignUserId; if ($userId <= 0 || $userId === $reassignUserId) { return false; } try { $users = self::quotedIdentifier($prefix . 'users'); $userMeta = self::quotedIdentifier($prefix . 'usermeta'); $posts = self::quotedIdentifier($prefix . 'posts'); if ($mysqli->begin_transaction() === false) { return false; } $authored = self::queryCount($mysqli, 'SELECT COUNT(*) AS `total` FROM ' . $posts . ' WHERE `post_author` = ' . $userId); if ($authored > 0) { if ($reassignUserId <= 0 || self::queryCount($mysqli, 'SELECT COUNT(*) AS `total` FROM ' . $users . ' WHERE `ID` = ' . $reassignUserId) !== 1) { $mysqli->rollback(); return false; } self::checkedQuery($mysqli, 'UPDATE ' . $posts . ' SET `post_author` = ' . $reassignUserId . ' WHERE `post_author` = ' . $userId); } self::checkedQuery($mysqli, 'DELETE FROM ' . $userMeta . ' WHERE `user_id` = ' . $userId); self::checkedQuery($mysqli, 'DELETE FROM ' . $users . ' WHERE `ID` = ' . $userId); if ($mysqli->affected_rows !== 1 || $mysqli->commit() === false) { throw new \RuntimeException('The user could not be deleted atomically.'); } return $userId; } catch (\Throwable $error) { try { $mysqli->rollback(); } catch (\Throwable $ignored) { } return false; } } public static function deleteOrphanedPosts($mysqli, $prefix = 'wp_', $postIds = []) { $successIds = []; $failed = 0; try { $posts = self::quotedIdentifier($prefix . 'posts'); $postMeta = self::quotedIdentifier($prefix . 'postmeta'); $comments = self::quotedIdentifier($prefix . 'comments'); $commentMeta = self::quotedIdentifier($prefix . 'commentmeta'); $termRelationships = self::quotedIdentifier($prefix . 'term_relationships'); $users = self::quotedIdentifier($prefix . 'users'); } catch (\Throwable $error) { return ['success' => 0, 'failed' => count($postIds), 'deleted' => []]; } foreach (array_slice(array_values(array_unique(array_map('intval', $postIds))), 0, self::MAX_DELETE_BATCH) as $postId) { if ($postId <= 0 || $mysqli->begin_transaction() === false) { $failed++; continue; } try { $orphan = self::queryCount( $mysqli, 'SELECT COUNT(*) AS `total` FROM ' . $posts . ' AS `p` LEFT JOIN ' . $users . ' AS `u` ON `u`.`ID` = `p`.`post_author` WHERE `p`.`ID` = ' . $postId . ' AND `p`.`post_author` <> 0 AND `u`.`ID` IS NULL' ); if ($orphan !== 1) { throw new \RuntimeException('The post is no longer orphaned.'); } self::checkedQuery($mysqli, 'DELETE `cm` FROM ' . $commentMeta . ' AS `cm` INNER JOIN ' . $comments . ' AS `c` ON `c`.`comment_ID` = `cm`.`comment_id` WHERE `c`.`comment_post_ID` = ' . $postId); self::checkedQuery($mysqli, 'DELETE FROM ' . $postMeta . ' WHERE `post_id` = ' . $postId); self::checkedQuery($mysqli, 'DELETE FROM ' . $comments . ' WHERE `comment_post_ID` = ' . $postId); self::checkedQuery($mysqli, 'DELETE FROM ' . $termRelationships . ' WHERE `object_id` = ' . $postId); self::checkedQuery($mysqli, 'DELETE FROM ' . $posts . ' WHERE `ID` = ' . $postId); if ($mysqli->affected_rows !== 1 || $mysqli->commit() === false) { throw new \RuntimeException('The post could not be deleted atomically.'); } $successIds[] = $postId; } catch (\Throwable $error) { $mysqli->rollback(); $failed++; } } return ['success' => count($successIds), 'failed' => $failed, 'deleted' => $successIds]; } private static function orphanedPostIds($mysqli, $prefix) { $posts = self::quotedIdentifier($prefix . 'posts'); $users = self::quotedIdentifier($prefix . 'users'); $result = self::checkedQuery( $mysqli, 'SELECT `p`.`ID` FROM ' . $posts . ' AS `p` LEFT JOIN ' . $users . ' AS `u` ON `u`.`ID` = `p`.`post_author` WHERE `p`.`post_author` <> 0 AND `u`.`ID` IS NULL' . ' ORDER BY `p`.`ID` ASC LIMIT ' . self::MAX_DELETE_BATCH ); $ids = []; while ($row = $result->fetch_assoc()) { $ids[] = (int)$row['ID']; } if (method_exists($result, 'free')) { $result->free(); } return $ids; } private static function quotedIdentifier($identifier) { if (!is_string($identifier) || !preg_match('/^[A-Za-z0-9_$]+$/', $identifier)) { throw new \RuntimeException('Unsafe database identifier.'); } return '`' . $identifier . '`'; } private static function checkedQuery($mysqli, $query) { $result = $mysqli->query($query); if ($result === false) { throw new \RuntimeException('A database remediation query failed.'); } return $result; } private static function queryCount($mysqli, $query) { $result = self::checkedQuery($mysqli, $query); $row = $result->fetch_assoc(); if (method_exists($result, 'free')) { $result->free(); } return (int)($row['total'] ?? 0); } private static function cleanupTriggers($mysqli, array $result, $database, callable $prompter, array &$summary) { $triggers = isset($result['raw_triggers']) && is_array($result['raw_triggers']) ? $result['raw_triggers'] : []; if ($triggers === []) { return; } CLI::writeLine('Found ' . count($triggers) . ' trigger(s) (suspicious):', 1, 'red'); foreach ($triggers as $trigger) { CLI::writeLine(' - ' . $trigger['trigger'] . ' on table ' . $trigger['table'] . ' (' . $trigger['event'] . ')'); $summary['detected']++; if ($prompter('Remove trigger ' . $trigger['trigger'] . ' [y|N]? ') !== 'y') { continue; } $deleted = self::deleteTrigger($mysqli, $trigger['trigger']); if ($deleted) { $summary['removed'][] = 'Trigger ' . $deleted . ' from DB ' . $database; CLI::writeLine('Trigger ' . $deleted . ' removed from DB ' . $database, 2, 'green'); } else { CLI::writeLine('Failed to remove trigger ' . $trigger['trigger'] . ' from DB ' . $database, 2, 'yellow'); } } CLI::writeBreak(); } private static function cleanupAdministrators($mysqli, array $result, $database, callable $prompter, array &$summary) { $users = isset($result['suspicious_administrators']) && is_array($result['suspicious_administrators']) ? $result['suspicious_administrators'] : []; if ($users === []) { return; } $whitelistPath = isset($result['admin_whitelist_path']) && $result['admin_whitelist_path'] ? $result['admin_whitelist_path'] : ''; CLI::writeLine('Found ' . count($users) . ' suspicious user(s):', 1, 'red'); foreach ($users as $user) { CLI::writeLine(' - ID: ' . $user['id'] . ', Login: ' . $user['login'] . ', Email: ' . $user['email']); if (!empty($user['url'])) { CLI::writeLine(' URL: ' . $user['url'], 1, 'yellow'); } $summary['detected']++; $choice = $prompter('Action: [R]emove user, [W]hitelist, [S]kip? '); $choice = strtolower(trim($choice)); if ($choice === 'w' && $whitelistPath !== '') { if (self::addUserToWhitelist($whitelistPath, $user, $result['target_id'] ?? '')) { $summary['whitelist'][] = 'User ' . $user['login'] . ' from DB ' . $database; CLI::writeLine('User added to whitelist: ' . $whitelistPath, 2, 'green'); } else { CLI::writeLine('Failed to add user ' . $user['login'] . ' to whitelist ' . $whitelistPath, 2, 'yellow'); } continue; } if ($choice !== 'r') { continue; } $reassignId = (int)$prompter('Reassign authored posts to user ID (0 if none): '); $deletedId = self::deleteUser($mysqli, $result['prefix'], $user['id'], $reassignId); if ($deletedId !== false) { $summary['removed'][] = 'User ID ' . $deletedId . ' (' . $user['login'] . ') from DB ' . $database; CLI::writeLine('User ID ' . $deletedId . ' (' . $user['login'] . ') removed from DB ' . $database, 2, 'green'); } else { CLI::writeLine('Failed to remove user ID ' . $user['id'] . ' from DB ' . $database, 2, 'yellow'); } } } private static function addUserToWhitelist(string $whitelistPath, array $user, string $targetId): bool { $whitelistPath = Path::get($whitelistPath); if (Whitelist::isCsv($whitelistPath)) { return false; } try { $entry = Whitelist::wpAdminEntry($targetId, $user); } catch (\InvalidArgumentException $error) { return false; } $whitelist = []; if (file_exists($whitelistPath)) { if (!is_file($whitelistPath) || !is_readable($whitelistPath)) { return false; } $contents = file_get_contents($whitelistPath); if ($contents === false) { return false; } if ($contents !== false) { $decoded = json_decode($contents, true); if (is_array($decoded)) { $whitelist = $decoded; } elseif (trim($contents) !== '') { return false; } } } $key = md5(json_encode($entry)); $whitelist = Whitelist::decode(json_encode($whitelist), false); $whitelist[$key] = $entry; $encoded = Whitelist::encode($whitelist, false); if ($encoded === false || Actions::putContents($whitelistPath, $encoded) === false) { return false; } return true; } private static function cleanupOrphanedPosts($mysqli, array $result, $database, $count, callable $prompter, array &$summary) { if ($count <= 0) { return; } CLI::writeLine('Found ' . $count . ' orphaned post(s) (no author account):', 1, 'red'); $sample = self::orphanedPostSample($result); foreach (array_slice($sample, 0, 10) as $post) { $title = trim($post['title'] ?? ''); if (strlen($title) > 60) { $title = substr($title, 0, 57) . '...'; } CLI::writeLine(' - ID: ' . ($post['id'] ?? '') . ', Title: ' . $title, 1, 'yellow'); } if ($count > 10) { CLI::writeLine(' ... and ' . ($count - 10) . ' more orphaned post(s)', 1, 'yellow'); } $summary['detected'] += $count; if ($prompter('Remove all orphaned posts [y|N]? ') === 'y') { self::removeAllOrphanedPosts($mysqli, $result['prefix'], $database, $summary); } CLI::writeBreak(); } private static function orphanedPostSample(array $result) { foreach ($result['findings'] as $finding) { if (isset($finding['rule_id']) && $finding['rule_id'] === 'database:orphaned-posts') { return $finding['evidence']['sample'] ?? []; } } return []; } private static function removeAllOrphanedPosts($mysqli, $prefix, $database, array &$summary) { $deletedIds = []; $failed = 0; do { try { $batch = self::orphanedPostIds($mysqli, $prefix); } catch (\Throwable $error) { $failed++; break; } if ($batch === []) { break; } $result = self::deleteOrphanedPosts($mysqli, $prefix, $batch); $deletedIds = array_merge($deletedIds, $result['deleted']); $failed += $result['failed']; if ($result['success'] === 0) { break; } } while (count($batch) === self::MAX_DELETE_BATCH); if ($deletedIds !== []) { $summary['removed'][] = count($deletedIds) . ' orphaned post(s) from DB ' . $database; } CLI::writeLine('Deleted ' . count($deletedIds) . ' orphaned post(s), ' . $failed . ' failed', 2, $failed > 0 ? 'yellow' : 'green'); } public static function interactiveCleanup(array $result, callable $prompter): array { $summary = ['detected' => 0, 'removed' => [], 'whitelist' => []]; $root = isset($result['root']) ? $result['root'] : ''; $database = !empty($result['database']) ? $result['database'] : '(unavailable)'; $orphanedCount = (int)($result['orphaned_post_count'] ?? 0); if (empty($root) || empty($result['raw_triggers']) && empty($result['suspicious_administrators']) && $orphanedCount === 0) { return $summary; } $mysqli = null; try { $databaseInstance = new self(); $credentials = $databaseInstance->readConfiguration($root); $mysqli = $databaseInstance->connect($credentials); } catch (\Throwable $e) { return $summary; } if (!is_object($mysqli) || !method_exists($mysqli, 'query')) { return $summary; } CLI::writeBreak(); CLI::writeLine('WordPress DB ' . $database . ' for ' . $root, 2); self::cleanupTriggers($mysqli, $result, $database, $prompter, $summary); self::cleanupAdministrators($mysqli, $result, $database, $prompter, $summary); self::cleanupOrphanedPosts($mysqli, $result, $database, $orphanedCount, $prompter, $summary); $mysqli->close(); return $summary; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\WordPress; use AMWScan\Console\CLI; use AMWScan\Detection\Signatures; use AMWScan\Filesystem\Cache; use AMWScan\Findings\Finding; use AMWScan\Integrity\Manifest; use AMWScan\Platform\VerifierInterface; class Verifier implements VerifierInterface { /** * Wordpress roots. * * @var array */ protected static $roots = []; /** * Time to live. * * @var int */ protected static $ttl = -1; /** * Time to cache failed checksum requests. * * @var int */ protected static $failureTtl = 3600; /** * Reset detected roots. */ public static function reset() { self::$roots = []; } /** * Initialize path. */ public static function init($path) { if (self::isRoot($path)) { $version = self::getVersion($path); if (!empty($version) && !isset(self::$roots[$path])) { $locale = self::getLocale($path); CLI::writeLine('Found WordPress ' . $version . ' (' . $locale . ') at "' . $path . '"', 1, 'green'); $plugins = self::getPlugins($path); self::$roots[$path] = [ 'path' => $path, 'version' => $version, 'locale' => $locale, 'plugins' => $plugins, ]; self::getChecksums($version, $locale); self::getPluginsChecksums($plugins); } } } /** * Discover a WordPress root without retrieving remote checksums. */ public static function discover($path) { if (!self::isRoot($path) || isset(self::$roots[$path])) { return; } $version = self::getVersion($path); $version = empty($version) ? 'unknown' : $version; $locale = self::getLocale($path); CLI::writeLine('Found WordPress ' . $version . ' (' . $locale . ') at "' . $path . '"', 1, 'green'); self::$roots[$path] = [ 'path' => $path, 'version' => $version, 'locale' => $locale, 'plugins' => [], ]; } /** * Discover the nearest WordPress root containing a selected path. */ public static function discoverFromPath($path) { $directory = is_dir($path) ? realpath($path) : realpath(dirname($path)); if ($directory === false) { return; } while (true) { self::discover($directory); if (isset(self::$roots[$directory])) { return; } $parent = dirname($directory); if ($parent === $directory) { return; } $directory = $parent; } } /** * Get all roots discovered during the current scan. * * @return array */ public static function getRoots() { return array_values(self::$roots); } /** * Detect root. * * @return bool */ public static function isRoot($path) { return is_dir($path) && is_dir($path . DIRECTORY_SEPARATOR . 'wp-admin') && is_dir($path . DIRECTORY_SEPARATOR . 'wp-content') && is_dir($path . DIRECTORY_SEPARATOR . 'wp-includes') && is_file($path . DIRECTORY_SEPARATOR . 'wp-includes' . DIRECTORY_SEPARATOR . 'version.php'); } /** * Get version. * * @return string|null */ public static function getVersion($root) { $versionFile = $root . DIRECTORY_SEPARATOR . 'wp-includes' . DIRECTORY_SEPARATOR . 'version.php'; if (is_file($versionFile)) { $versionContent = file_get_contents($versionFile); if (is_string($versionContent) && preg_match('/\$wp_version[\s]*=[\s]*[\'"]([0-9.]+)[\'"]/m', $versionContent, $match) && !empty($match[1])) { return trim($match[1]); } } return null; } /** * Get locale. * * @return string */ public static function getLocale($root) { $versionFile = $root . DIRECTORY_SEPARATOR . 'wp-includes' . DIRECTORY_SEPARATOR . 'version.php'; if (is_file($versionFile)) { $versionContent = file_get_contents($versionFile); if (is_string($versionContent) && preg_match('/\$wp_local_package[\s]*=[\s]*[\'"]([A-Za-z_-]+)[\'"]/m', $versionContent, $match) && !empty($match[1])) { return $match[1]; } } return 'en_US'; } /** * Get plugins. * * @return string[] */ public static function getPlugins($root) { $plugins = []; $files = new \GlobIterator($root . DIRECTORY_SEPARATOR . 'wp-content' . DIRECTORY_SEPARATOR . 'plugins' . DIRECTORY_SEPARATOR . '*' . DIRECTORY_SEPARATOR . '*.php'); foreach ($files as $cur) { if ($cur->isFile()) { $headers = self::getPluginHeaders($cur->getPathname()); if (!empty($headers['name']) && !empty($headers['version'])) { if (empty($headers['domain'])) { $headers['domain'] = $cur->getBasename('.' . $cur->getExtension()); } $headers['path'] = $cur->getPath(); $plugins[$cur->getPath()] = $headers; CLI::writeLine('Found WordPress Plugin ' . $headers['name'] . ' ' . $headers['version'], 1, 'green'); } } } return $plugins; } /** * Get file headers. * * @return string[] */ public static function getPluginHeaders($file) { $headers = ['name' => 'Plugin Name', 'version' => 'Version', 'domain' => 'Text Domain']; $fileData = file_get_contents($file); $fileData = str_replace("\r", "\n", $fileData); foreach ($headers as $field => $regex) { if (preg_match('/^[ \t\/*#@]*' . preg_quote($regex, '/') . ':(.*)$/mi', $fileData, $match) && $match[1]) { $headers[$field] = trim(preg_replace('/\s*(?:\*\/|\?>).*/', '', $match[1])); } else { $headers[$field] = ''; } } return $headers; } /** * Get checksums. * * @param string $version * @param string $locale * * @return array|false */ public static function getChecksums($version, $locale = 'en_US') { $cache = Cache::getInstance(); $key = 'wordpress_v3_' . $locale . '-' . $version; $checksums = $cache->get($key); if (is_null($checksums)) { CLI::writeLine('Retrieving checksums of Wordpress ' . $version, 1, 'grey'); $checksums = []; $dataChecksums = static::getData('https://api.wordpress.org/core/checksums/1.0/?version=' . $version . '&locale=' . $locale); if (!is_array($dataChecksums) || !isset($dataChecksums['checksums']) || !is_array($dataChecksums['checksums'])) { $cache->set($key, false, self::$failureTtl); return false; } // Sanitize paths and checksum foreach ($dataChecksums['checksums'] as $filePath => $checksum) { if (!is_string($filePath)) { continue; } $checksum = self::normalizeChecksums($checksum); if (empty($checksum)) { continue; } $sanitizePath = self::sanitizePath($filePath); $checksums[$sanitizePath] = $checksum; } $cache->set($key, $checksums, empty($checksums) ? self::$failureTtl : self::$ttl); } return $checksums; } /** * Get plugins checksums. * * @param array $plugins * * @return array|false */ public static function getPluginsChecksums($plugins = []) { $cache = Cache::getInstance(); $pluginsChecksums = []; foreach ($plugins as $plugin) { $key = 'wordpress-plugin_v4_' . $plugin['domain'] . '-' . $plugin['version']; $checksums = $cache->get($key); if (!is_null($checksums)) { $pluginsChecksums[$plugin['domain']][$plugin['version']] = $checksums; continue; } CLI::writeLine('Retrieving checksums of Wordpress Plugin ' . $plugin['name'] . ' ' . $plugin['version'], 1, 'grey'); $dataChecksums = static::getData('https://downloads.wordpress.org/plugin-checksums/' . $plugin['domain'] . '/' . $plugin['version'] . '.json'); if (!is_array($dataChecksums) || !isset($dataChecksums['files']) || !is_array($dataChecksums['files'])) { $cache->set($key, [], self::$failureTtl); $pluginsChecksums[$plugin['domain']][$plugin['version']] = []; continue; } $checksums = []; foreach ($dataChecksums['files'] as $filePath => $checksum) { if (!is_string($filePath) || !is_array($checksum) || !array_key_exists('md5', $checksum)) { continue; } $checksum = self::normalizeChecksums($checksum['md5']); if (empty($checksum)) { continue; } $path = $plugin['path'] . DIRECTORY_SEPARATOR . $filePath; $root = self::getRoot($path); if (empty($root)) { continue; } $sanitizePath = self::relativePath($root['path'], $path); $checksums[$sanitizePath] = $checksum; } $cache->set($key, $checksums, empty($checksums) ? self::$failureTtl : self::$ttl); $pluginsChecksums[$plugin['domain']][$plugin['version']] = $checksums; } return $pluginsChecksums; } /** * Is verified file. * * @return bool */ public static function isVerified($path) { if (!is_file($path)) { return false; } $root = self::getRoot($path); if (!empty($root)) { $comparePath = self::relativePath($root['path'], $path); $checksums = self::getChecksums($root['version'], $root['locale']); if (!$checksums) { return false; } // Core if (!empty($checksums[$comparePath])) { $checksum = md5_file($path); if ($checksum === false) { return false; } $checksum = strtolower($checksum); return self::matchesChecksum($checksums[$comparePath], $checksum); } // Plugins $pluginRoot = self::getPluginRoot($root, $path); $pluginsChecksums = self::getPluginsChecksums($root['plugins']); if (!empty($root['plugins'][$pluginRoot])) { $plugin = $root['plugins'][$pluginRoot]; $checksums = $pluginsChecksums[$plugin['domain']][$plugin['version']]; if (!empty($pluginsChecksums[$plugin['domain']][$plugin['version']]) && !empty($checksums[$comparePath])) { $checksum = md5_file($path); if ($checksum === false) { return false; } $checksum = strtolower($checksum); return self::matchesChecksum($checksums[$comparePath], $checksum); } } } return false; } /** * Build trusted manifests for discovered core and plugin installations. * * @return Manifest[] */ public static function getIntegrityManifests($path) { self::init($path); $manifests = []; foreach (self::$roots as $root) { $coreChecksums = self::getChecksums($root['version'], $root['locale']); if (is_array($coreChecksums) && !empty($coreChecksums)) { $manifests[] = new Manifest( $root['path'], 'wordpress-core-' . $root['version'] . '-' . $root['locale'], self::coreManifestEntries($coreChecksums), ['wp-admin', 'wp-includes'] ); } $pluginChecksums = self::getPluginsChecksums($root['plugins']); foreach ($root['plugins'] as $plugin) { $checksums = isset($pluginChecksums[$plugin['domain']][$plugin['version']]) ? $pluginChecksums[$plugin['domain']][$plugin['version']] : []; if (empty($checksums)) { continue; } $entries = []; foreach ($checksums as $relativePath => $checksum) { $entries[str_replace('\\', '/', $relativePath)] = [ 'algorithm' => 'md5', 'hashes' => is_array($checksum) ? $checksum : [$checksum], ]; } $pluginRelativePath = self::relativePath($root['path'], $plugin['path']); $manifests[] = new Manifest( $root['path'], 'wordpress-plugin-' . $plugin['domain'] . '-' . $plugin['version'], $entries, [$pluginRelativePath] ); } } return $manifests; } /** * Collapse file-level plugin integrity failures into one plugin finding. */ public static function aggregateIntegrityFindings(Manifest $manifest, array $findings) { if (strpos($manifest->getVersion(), 'wordpress-plugin-') !== 0 || empty($findings)) { return $findings; } $managedRoots = $manifest->getManagedRoots(); if (empty($managedRoots)) { return $findings; } $statusCounts = []; $issues = []; foreach ($findings as $finding) { $status = substr($finding['rule_id'], strlen('integrity:')); $statusCounts[$status] = isset($statusCounts[$status]) ? $statusCounts[$status] + 1 : 1; $issues[] = [ 'path' => $finding['evidence']['relative_path'], 'status' => $status, ]; } usort($issues, static function ($left, $right) { return strcmp($left['path'], $right['path']); }); $provider = isset($findings[0]['provider']) ? $findings[0]['provider'] : 'trusted-manifest'; return [Finding::create( 'integrity', $manifest->path($managedRoots[0]), 'integrity:plugin', 'warn', 'A WordPress plugin contains files that differ from its trusted manifest.', [ 'manifest_version' => $manifest->getVersion(), 'issue_count' => count($findings), 'issue_counts' => $statusCounts, 'issues' => $issues, 'content_hash' => self::aggregateContentHash($findings), ], $provider )]; } private static function aggregateContentHash(array $findings) { $evidence = array_map(static function ($finding) { return [ 'id' => $finding['id'], 'severity' => $finding['severity'], 'evidence' => $finding['evidence'], ]; }, $findings); usort($evidence, static function ($left, $right) { return strcmp($left['id'], $right['id']); }); $json = json_encode($evidence, JSON_UNESCAPED_SLASHES | JSON_INVALID_UTF8_SUBSTITUTE); if (!is_string($json)) { throw new \RuntimeException('Unable to encode WordPress integrity evidence.'); } return hash('sha256', $json); } private static function coreManifestEntries(array $checksums) { $entries = []; foreach ($checksums as $relativePath => $checksum) { $relativePath = str_replace('\\', '/', $relativePath); if (strpos(strtolower($relativePath), 'wp-content/') === 0) { continue; } $entries[$relativePath] = [ 'algorithm' => 'md5', 'hashes' => is_array($checksum) ? $checksum : [$checksum], ]; } return $entries; } /** * Identify files from historical core releases in restricted directories. * * @return array */ public static function binarySignatureFindings($path) { if (!is_file($path) || is_link($path)) { return []; } $root = self::findFilesystemRoot($path); if ($root === null) { return []; } $normalizedPath = str_replace('\\', '/', $path); $normalizedRoot = rtrim(str_replace('\\', '/', $root['path']), '/'); if (strpos($normalizedPath, $normalizedRoot . '/wp-admin/') !== 0 && strpos($normalizedPath, $normalizedRoot . '/wp-includes/') !== 0) { return []; } $sha256 = Signatures::normalizedFileSha256($path); if (!is_string($sha256) || !Signatures::matchesLegacyCoreSha256($sha256)) { return []; } return [Finding::create( 'integrity', $path, 'integrity:historical-core', 'warn', 'A restricted core directory contains a file matching a historical core release.', ['sha256' => $sha256, 'content_hash' => hash_file('sha256', $path)], 'builtin-signatures' )]; } private static function findFilesystemRoot($path) { $directory = dirname($path); for ($depth = 0; $depth < 32; $depth++) { if (self::isRoot($directory)) { return ['path' => $directory]; } $parent = dirname($directory); if ($parent === $directory) { break; } $directory = $parent; } return null; } /** * Get root from child file. * * @return array */ public static function getRoot($path) { $path = rtrim(str_replace('\\', '/', $path), '/'); $match = null; foreach (self::$roots as $root) { $rootPath = rtrim(str_replace('\\', '/', $root['path']), '/'); if (DIRECTORY_SEPARATOR === '\\') { $candidatePath = strtolower($path); $candidateRoot = strtolower($rootPath); } else { $candidatePath = $path; $candidateRoot = $rootPath; } if (($candidatePath === $candidateRoot || strpos($candidatePath, $candidateRoot . '/') === 0) && ($match === null || strlen($rootPath) > strlen($match['path']))) { $match = $root; } } return $match; } /** * Get root from child plugin file. * * @return mixed|null */ protected static function getPluginRoot($root, $path) { $normalizedPath = rtrim(str_replace('\\', '/', $path), '/'); foreach (array_keys($root['plugins']) as $pluginPath) { $normalizedPluginPath = rtrim(str_replace('\\', '/', $pluginPath), '/'); if (DIRECTORY_SEPARATOR === '\\') { $candidatePath = strtolower($normalizedPath); $candidatePluginPath = strtolower($normalizedPluginPath); } else { $candidatePath = $normalizedPath; $candidatePluginPath = $normalizedPluginPath; } if ($candidatePath === $candidatePluginPath || strpos($candidatePath, $candidatePluginPath . '/') === 0) { return $pluginPath; } } return null; } /** * Normalize one or more checksums. * * @return array|string */ private static function normalizeChecksums($checksums) { if (!is_array($checksums)) { return is_string($checksums) ? strtolower($checksums) : ''; } $normalized = []; foreach ($checksums as $checksum) { if (is_string($checksum) && $checksum !== '') { $normalized[] = strtolower($checksum); } } return array_values(array_unique($normalized)); } /** * Compare a file checksum with one or more trusted values. */ private static function matchesChecksum($checksums, $checksum) { $checksums = self::normalizeChecksums($checksums); return is_array($checksums) ? in_array($checksum, $checksums, true) : $checksums === $checksum; } /** * Convert a path contained by a root into a relative path. * * @return string */ private static function relativePath($root, $path) { $normalizedRoot = rtrim(str_replace('\\', '/', $root), '/'); $normalizedPath = str_replace('\\', '/', $path); $rootPrefix = $normalizedRoot . '/'; $candidateRoot = DIRECTORY_SEPARATOR === '\\' ? strtolower($rootPrefix) : $rootPrefix; $candidatePath = DIRECTORY_SEPARATOR === '\\' ? strtolower($normalizedPath) : $normalizedPath; if (strpos($candidatePath, $candidateRoot) !== 0) { throw new \InvalidArgumentException(sprintf('Path "%s" is outside root "%s".', $path, $root)); } return self::sanitizePath(substr($normalizedPath, strlen($rootPrefix))); } /** * Sanitize path to be compared. * * @return string */ public static function sanitizePath($path) { $sanitized = preg_replace('#[\\\\/]+#', DIRECTORY_SEPARATOR, $path); $sanitized = trim($sanitized); $sanitized = trim($sanitized, DIRECTORY_SEPARATOR); return DIRECTORY_SEPARATOR === '\\' ? strtolower($sanitized) : $sanitized; } /** * HTTP request get data. * * @return mixed|null */ protected static function getData($url) { $headers = get_headers($url); if (substr($headers[0], 9, 3) !== '200') { return null; } $content = @file_get_contents($url); return @json_decode($content, true); } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\CodeIgniter; use AMWScan\Platform\ProcessApiProviderAbstract; class ProcessApiProvider extends ProcessApiProviderAbstract { private const SERVE_TYPE = 'codeigniter-serve-command'; public function getClassTypes() { return [ 'codeigniter\commands\server\serve' => self::SERVE_TYPE, ]; } public function getTypeDetails() { return [ self::SERVE_TYPE => [ 'platform' => 'CodeIgniter', 'api' => 'CodeIgniter development server', 'instanceTerminals' => ['run'], 'staticTerminals' => [], ], ]; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\CodeIgniter; use AMWScan\Platform\ComposerPackageVerifierAbstract; class Verifier extends ComposerPackageVerifierAbstract { protected static function getPackageNames() { return [ 'codeigniter/framework', 'codeigniter4/framework', ]; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\Drupal; use AMWScan\Platform\ProcessApiProviderAbstract; class ProcessApiProvider extends ProcessApiProviderAbstract { private const DRUSH_TYPE = 'drush-facade'; private const MANAGER_TYPE = 'drush-manager'; private const PROCESS_TYPE = 'drush-process'; public function getClassTypes() { return [ 'drush\\drush' => self::DRUSH_TYPE, 'drush\\sitealias\\processmanager' => self::MANAGER_TYPE, ]; } public function getTypeDetails() { return [ self::DRUSH_TYPE => $this->details('Drush process factory'), self::MANAGER_TYPE => $this->details('Drush process manager'), self::PROCESS_TYPE => [ 'platform' => 'Drupal / Drush', 'api' => 'Drush process', 'instanceTerminals' => ['run', 'mustrun', 'start', 'restart'], 'staticTerminals' => [], ], ]; } public function getStaticReturnTypes() { return [self::DRUSH_TYPE => array_fill_keys($this->factories(), self::PROCESS_TYPE)]; } public function getInstanceReturnTypes() { return [ self::DRUSH_TYPE => array_fill_keys($this->factories(), self::PROCESS_TYPE), self::MANAGER_TYPE => array_fill_keys($this->factories(), self::PROCESS_TYPE), ]; } public function getFunctions() { $details = [ 'platform' => 'Drupal / Drush', 'api' => 'legacy Drush process helper', ]; return array_fill_keys([ 'drush_shell_exec', 'drush_op_system', 'drush_shell_exec_interactive', 'drush_shell_proc_open', ], $details); } private function factories() { return ['process', 'shell', 'drush', 'siteprocess']; } private function details($api) { return [ 'platform' => 'Drupal / Drush', 'api' => $api, 'instanceTerminals' => [], 'staticTerminals' => [], ]; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\Drupal; use AMWScan\Platform\RepositoryVerifier; class Verifier extends RepositoryVerifier { protected static $roots = []; public static function isRoot($path) { return is_dir($path) && is_dir($path . DIRECTORY_SEPARATOR . 'core') && is_dir($path . DIRECTORY_SEPARATOR . 'sites') && is_file($path . DIRECTORY_SEPARATOR . 'index.php') && is_file(static::getVersionFile($path)); } public static function getVersion($root) { $content = @file_get_contents(static::getVersionFile($root)); if ($content !== false && preg_match('/\bconst\s+VERSION\s*=\s*[\'"]([0-9][0-9A-Za-z.\-]*)[\'"]/', $content, $match)) { return $match[1]; } return null; } protected static function getPlatformName() { return 'Drupal'; } protected static function getRepository() { return 'drupal/drupal'; } private static function getVersionFile($root) { return $root . DIRECTORY_SEPARATOR . 'core' . DIRECTORY_SEPARATOR . 'lib' . DIRECTORY_SEPARATOR . 'Drupal.php'; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform; use AMWScan\Platform\Composer\Verifier as ComposerVerifier; abstract class ComposerPackageVerifierAbstract implements VerifierInterface { public static function init($path) { ComposerVerifier::init($path); } public static function reset() { ComposerVerifier::reset(); } public static function getDelegateVerifier() { return ComposerVerifier::class; } public static function isVerified($path) { return ComposerVerifier::isPackageVerified($path, static::getPackageNames()); } /** * @return string[] */ abstract protected static function getPackageNames(); } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\Symfony; use AMWScan\Platform\ProcessApiProviderAbstract; class ProcessApiProvider extends ProcessApiProviderAbstract { private const PROCESS_TYPE = 'symfony-process'; private const PROCESS_BUILDER_TYPE = 'symfony-process-builder'; private const PROCESS_MESSAGE_TYPE = 'symfony-run-process-message'; private const MESSAGE_BUS_TYPE = 'symfony-message-bus'; public function getClassTypes() { return [ 'symfony\\component\\process\\process' => self::PROCESS_TYPE, 'symfony\\component\\process\\phpprocess' => self::PROCESS_TYPE, 'symfony\\component\\process\\phpsubprocess' => self::PROCESS_TYPE, 'symfony\\component\\process\\processbuilder' => self::PROCESS_BUILDER_TYPE, 'symfony\\component\\process\\messenger\\runprocessmessage' => self::PROCESS_MESSAGE_TYPE, 'symfony\\component\\messenger\\messagebusinterface' => self::MESSAGE_BUS_TYPE, 'symfony\\component\\messenger\\messagebus' => self::MESSAGE_BUS_TYPE, ]; } public function getTypeDetails() { return [ self::PROCESS_TYPE => [ 'platform' => 'Symfony', 'api' => 'Symfony Process', 'instanceTerminals' => ['run', 'mustrun', 'start', 'restart'], 'staticTerminals' => [], ], self::PROCESS_BUILDER_TYPE => $this->details('Symfony ProcessBuilder'), self::PROCESS_MESSAGE_TYPE => $this->details('Symfony RunProcessMessage'), self::MESSAGE_BUS_TYPE => [ 'platform' => 'Symfony', 'api' => 'Symfony Messenger process message', 'instanceTerminals' => ['dispatch'], 'staticTerminals' => [], ], ]; } public function getStaticReturnTypes() { return [ self::PROCESS_TYPE => [ 'fromshellcommandline' => self::PROCESS_TYPE, ], self::PROCESS_BUILDER_TYPE => [ 'create' => self::PROCESS_BUILDER_TYPE, ], self::PROCESS_MESSAGE_TYPE => [ 'fromshellcommandline' => self::PROCESS_MESSAGE_TYPE, ], ]; } public function getInstanceReturnTypes() { $methods = [ 'setinput', 'setworkingdirectory', 'setenv', 'settimeout', 'setidletimeout', 'settty', 'setpty', 'setoptions', 'disableoutput', 'enableoutput', 'setignoredsignals', ]; $builderMethods = [ 'add', 'setprefix', 'setarguments', 'setworkingdirectory', 'inheritenvironmentvariables', 'setenv', 'addenvironmentvariables', 'setinput', 'settimeout', 'setoption', 'disableoutput', 'enableoutput', ]; return [ self::PROCESS_TYPE => array_fill_keys($methods, self::PROCESS_TYPE), self::PROCESS_BUILDER_TYPE => array_fill_keys($builderMethods, self::PROCESS_BUILDER_TYPE) + ['getprocess' => self::PROCESS_TYPE], ]; } public function allowsInstanceTerminalCall($type, $method, array $arguments, array $argumentTypes) { if ($type !== self::MESSAGE_BUS_TYPE || $method !== 'dispatch') { return true; } return isset($argumentTypes[0]) && $argumentTypes[0] === self::PROCESS_MESSAGE_TYPE; } private function details($api) { return [ 'platform' => 'Symfony', 'api' => $api, 'instanceTerminals' => [], 'staticTerminals' => [], ]; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\Symfony; use AMWScan\Platform\ComposerPackageVerifierAbstract; class Verifier extends ComposerPackageVerifierAbstract { protected static function getPackageNames() { return [ 'symfony/framework-bundle', 'symfony/http-kernel', 'symfony/process', 'symfony/symfony', ]; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\Composer; class Inventory { private const MAX_LOCK_BYTES = 16777216; private const MAX_PROJECTS = 64; public function supports($path) { return file_exists($path); } public function collect($path) { $root = realpath($path); if ($root === false) { throw new \InvalidArgumentException('Composer inventory path does not exist.'); } $root = is_file($root) ? dirname($root) : $root; $components = []; foreach ($this->lockFiles($root) as $lockPath) { foreach ($this->readPackages($lockPath) as $package) { $key = strtolower($package['name']) . "\0" . dirname($lockPath); $packagePath = dirname($lockPath) . DIRECTORY_SEPARATOR . 'vendor' . DIRECTORY_SEPARATOR . str_replace('/', DIRECTORY_SEPARATOR, strtolower($package['name'])); if (!is_dir($packagePath)) { continue; } $components[$key] = [ 'ecosystem' => 'composer', 'package' => strtolower($package['name']), 'version' => ltrim($package['version'], 'v'), 'path' => $packagePath, ]; } } $components = array_values($components); usort($components, static function (array $left, array $right) { return strcmp($left['package'], $right['package']); }); return $components; } private function lockFiles($root) { $locks = []; if (is_file($root . DIRECTORY_SEPARATOR . 'composer.lock')) { $locks[] = $root . DIRECTORY_SEPARATOR . 'composer.lock'; } $directory = new \RecursiveDirectoryIterator($root, \FilesystemIterator::SKIP_DOTS); $filter = new \RecursiveCallbackFilterIterator($directory, static function ($item) { return !$item->isDir() || !in_array(strtolower($item->getFilename()), ['vendor', '.git', '.svn', 'node_modules'], true); }); $iterator = new \RecursiveIteratorIterator($filter); foreach ($iterator as $item) { if ($item->isFile() && strtolower($item->getFilename()) === 'composer.lock') { $locks[$item->getPathname()] = $item->getPathname(); if (count($locks) >= self::MAX_PROJECTS) { break; } } } return array_values(array_unique($locks)); } private function readPackages($lockPath) { $size = filesize($lockPath); if ($size === false || $size > self::MAX_LOCK_BYTES) { return []; } $contents = file_get_contents($lockPath); $data = is_string($contents) ? json_decode($contents, true) : null; if (!is_array($data)) { return []; } $packages = array_merge( isset($data['packages']) && is_array($data['packages']) ? $data['packages'] : [], isset($data['packages-dev']) && is_array($data['packages-dev']) ? $data['packages-dev'] : [] ); return array_values(array_filter($packages, static function ($package) { return is_array($package) && isset($package['name'], $package['version']) && is_string($package['name']) && is_string($package['version']) && preg_match('~^[a-z0-9_.-]+/[a-z0-9_.-]+$~i', $package['name']) && preg_match('/^v?[0-9][0-9A-Za-z._+-]*$/', $package['version']); })); } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\Composer; use AMWScan\Filesystem\Cache; use AMWScan\Findings\Finding; use AMWScan\Integrity\Manifest; use AMWScan\Platform\VerifierInterface; class Verifier implements VerifierInterface { protected const MAX_ARCHIVE_BYTES = 33554432; protected const MAX_EXPANDED_BYTES = 268435456; protected const MAX_ENTRY_BYTES = 16777216; protected const MAX_ARCHIVE_FILES = 20000; protected const MAX_REQUESTS = 64; protected const MANIFEST_TTL = 86400; /** * @var array */ protected static $packages = []; /** * @var array */ protected static $projects = []; /** * @var callable|null */ protected static $fetcher; /** * @var int */ protected static $requests = 0; /** * Reset detected Composer projects. */ public static function reset() { self::$packages = []; self::$projects = []; self::$requests = 0; } /** * Override the network fetcher, primarily for deterministic integrations. * * @param callable|null $fetcher */ public static function setFetcher($fetcher) { if ($fetcher !== null && !is_callable($fetcher)) { throw new \InvalidArgumentException('Composer fetcher must be callable or null'); } self::$fetcher = $fetcher; } /** * Discover a Composer project and its installed package roots. */ public static function init($path) { $projectRoot = realpath($path); if ($projectRoot === false || isset(self::$projects[$projectRoot])) { return; } $lockPath = $projectRoot . DIRECTORY_SEPARATOR . 'composer.lock'; $composerRoot = $projectRoot . DIRECTORY_SEPARATOR . 'vendor' . DIRECTORY_SEPARATOR . 'composer'; $installedPath = $composerRoot . DIRECTORY_SEPARATOR . 'installed.json'; if (!is_file($lockPath) || !is_file($installedPath)) { return; } self::$projects[$projectRoot] = true; $lock = self::readJson($lockPath); $installed = self::readJson($installedPath); if ($lock === null || $installed === null) { return; } $installedPackages = isset($installed['packages']) && is_array($installed['packages']) ? $installed['packages'] : $installed; $installedRoots = self::installedRoots($installedPackages, $projectRoot, $composerRoot); $lockedPackages = array_merge( isset($lock['packages']) && is_array($lock['packages']) ? $lock['packages'] : [], isset($lock['packages-dev']) && is_array($lock['packages-dev']) ? $lock['packages-dev'] : [] ); foreach ($lockedPackages as $package) { if (!is_array($package) || empty($package['name']) || empty($package['version'])) { continue; } $name = strtolower($package['name']); if (!isset($installedRoots[$name])) { continue; } $installedPackage = $installedRoots[$name]; if (!empty($installedPackage['version']) && $installedPackage['version'] !== $package['version']) { continue; } $dist = isset($package['dist']) && is_array($package['dist']) ? $package['dist'] : []; if (!isset($dist['type']) || strtolower($dist['type']) !== 'zip') { continue; } $root = $installedPackage['root']; self::$packages[$root] = [ 'name' => $name, 'version' => $package['version'], 'reference' => isset($dist['reference']) ? (string)$dist['reference'] : '', 'dist-url' => isset($dist['url']) ? (string)$dist['url'] : '', 'dist-shasum' => isset($dist['shasum']) ? (string)$dist['shasum'] : '', 'root' => $root, 'manifest' => null, ]; } } /** * Return true only when the installed file matches its trusted archive. * * @return bool */ public static function isVerified($path) { return self::isPackageVerified($path); } /** * Return true only when the file belongs to an allowed package and matches its trusted archive. * * @param string[]|null $packageNames */ public static function isPackageVerified($path, ?array $packageNames = null) { if (!is_file($path) || is_link($path)) { return false; } $realPath = realpath($path); if ($realPath === false) { return false; } $packageRoot = self::findPackageRoot($realPath); if ($packageRoot === null) { return false; } $package = self::$packages[$packageRoot]; if ($packageNames !== null) { $packageNames = array_map('strtolower', $packageNames); if (!in_array($package['name'], $packageNames, true)) { return false; } } if ($package['manifest'] === null) { $package['manifest'] = self::loadManifest($package); self::$packages[$packageRoot] = $package; } if (!is_array($package['manifest'])) { return false; } $relativePath = str_replace('\\', '/', substr($realPath, strlen($packageRoot) + 1)); if (!isset($package['manifest'][$relativePath])) { return false; } $hash = hash_file('sha256', $realPath); return is_string($hash) && hash_equals($package['manifest'][$relativePath], $hash); } /** * Build trusted manifests for discovered installed packages. * * @return Manifest[] */ public static function getIntegrityManifests($path) { self::init($path); $manifests = []; foreach (self::$packages as $packageRoot => $package) { if ($package['manifest'] === null) { $package['manifest'] = self::loadManifest($package); self::$packages[$packageRoot] = $package; } if (!is_array($package['manifest'])) { continue; } $entries = []; foreach ($package['manifest'] as $relativePath => $checksum) { $entries[$relativePath] = ['algorithm' => 'sha256', 'hash' => $checksum]; } $manifests[] = new Manifest( $packageRoot, 'composer-' . $package['name'] . '-' . $package['version'], $entries ); } return $manifests; } /** * Collapse file-level package integrity failures into one package finding. */ public static function aggregateIntegrityFindings(Manifest $manifest, array $findings) { if (strpos($manifest->getVersion(), 'composer-') !== 0 || empty($findings)) { return $findings; } $findings = array_values(array_filter($findings, static function ($finding) { if (!isset($finding['rule_id'], $finding['evidence']['relative_path']) || $finding['rule_id'] !== 'integrity:missing') { return true; } return !preg_match('~(?:^|/)(?:tests?)(?:/|$)~i', str_replace('\\', '/', $finding['evidence']['relative_path'])); })); if (empty($findings)) { return []; } $statusCounts = []; $issues = []; foreach ($findings as $finding) { $status = substr($finding['rule_id'], strlen('integrity:')); $statusCounts[$status] = isset($statusCounts[$status]) ? $statusCounts[$status] + 1 : 1; $issues[] = [ 'path' => $finding['evidence']['relative_path'], 'status' => $status, ]; } usort($issues, static function ($left, $right) { return strcmp($left['path'], $right['path']); }); $provider = isset($findings[0]['provider']) ? $findings[0]['provider'] : 'trusted-manifest'; return [Finding::create( 'integrity', $manifest->getRoot(), 'integrity:composer-package', 'warn', 'An installed Composer package contains files that differ from its trusted distribution.', [ 'manifest_version' => $manifest->getVersion(), 'issue_count' => count($findings), 'issue_counts' => $statusCounts, 'issues' => $issues, 'content_hash' => self::aggregateContentHash($findings), ], $provider )]; } private static function aggregateContentHash(array $findings) { $evidence = array_map(static function ($finding) { return [ 'id' => $finding['id'], 'severity' => $finding['severity'], 'evidence' => $finding['evidence'], ]; }, $findings); usort($evidence, static function ($left, $right) { return strcmp($left['id'], $right['id']); }); $json = json_encode($evidence, JSON_UNESCAPED_SLASHES | JSON_INVALID_UTF8_SUBSTITUTE); if (!is_string($json)) { throw new \RuntimeException('Unable to encode Composer integrity evidence.'); } return hash('sha256', $json); } /** * @return array|null */ protected static function readJson($path) { $content = file_get_contents($path); if ($content === false) { return null; } $data = json_decode($content, true); return is_array($data) ? $data : null; } /** * @return array */ protected static function installedRoots($packages, $projectRoot, $composerRoot) { $roots = []; $vendorRoot = realpath($projectRoot . DIRECTORY_SEPARATOR . 'vendor'); if ($vendorRoot === false || !is_array($packages)) { return $roots; } foreach ($packages as $package) { if (!is_array($package) || empty($package['name'])) { continue; } $name = strtolower($package['name']); $candidate = null; if (!empty($package['install-path']) && is_string($package['install-path'])) { $candidate = $composerRoot . DIRECTORY_SEPARATOR . str_replace(['/', '\\'], DIRECTORY_SEPARATOR, $package['install-path']); } elseif (strpos($name, '/') !== false) { $candidate = $vendorRoot . DIRECTORY_SEPARATOR . str_replace('/', DIRECTORY_SEPARATOR, $name); } $root = $candidate === null ? false : realpath($candidate); if ($root === false || !is_dir($root) || !self::isWithin($root, $vendorRoot)) { continue; } $roots[$name] = [ 'root' => $root, 'version' => isset($package['version']) ? (string)$package['version'] : '', ]; } return $roots; } /** * @return string|null */ protected static function findPackageRoot($path) { $match = null; foreach (self::$packages as $root => $package) { if (self::isWithin($path, $root) && ($match === null || strlen($root) > strlen($match))) { $match = $root; } } return $match; } /** * @return array|false */ protected static function loadManifest($package) { $bundledPluginVersion = self::bundledPluginVersion($package); $cacheKey = 'composer-manifest-v3-' . sha1( $package['name'] . '|' . $package['version'] . '|' . $package['reference'] . '|' . $package['dist-url'] . '|' . $package['dist-shasum'] . '|' . ($bundledPluginVersion === null ? '' : $bundledPluginVersion) ); $useCache = self::$fetcher === null; /** @var Cache $cache */ $cache = Cache::getInstance(); if ($useCache) { $cached = $cache->get($cacheKey); if (self::isValidManifest($cached)) { return $cached; } if ($cached !== null) { $cache->delete($cacheKey); } } $metadataSuffix = strpos($package['version'], 'dev') !== false ? '~dev.json' : '.json'; $metadataUrl = 'https://repo.packagist.org/p2/' . self::encodePackageName($package['name']) . $metadataSuffix; $metadataContent = self::fetch($metadataUrl, 2097152); if ($metadataContent === false) { return false; } $metadata = json_decode($metadataContent, true); $dist = self::trustedDist($metadata, $package); if ($dist === null) { return false; } $archive = self::fetch($dist['url'], self::MAX_ARCHIVE_BYTES); if ($archive === false) { return false; } if ($dist['shasum'] !== '' && !hash_equals(strtolower($dist['shasum']), sha1($archive))) { return false; } $manifest = self::archiveManifest($archive); if (!is_array($manifest)) { return false; } if ($bundledPluginVersion !== null) { $manifest = self::withBundledPluginSource($manifest, $bundledPluginVersion); } if ($useCache) { $cache->set($cacheKey, $manifest, self::MANIFEST_TTL); } return $manifest; } /** * Return the WordPress plugin version when this package is its synchronized engine. * * @return string|null */ protected static function bundledPluginVersion($package) { if ($package['name'] !== 'marcocesarato/amwscan') { return null; } $pluginRoot = dirname($package['root'], 3); $pluginFile = $pluginRoot . DIRECTORY_SEPARATOR . 'php-antimalware-scanner.php'; if (!is_file($pluginFile)) { return null; } $header = file_get_contents($pluginFile, false, null, 0, 8192); if (!is_string($header) || !preg_match('/^[ \t*#@\/]*Plugin Name:\s*AMWScan Antimalware Scanner\s*$/mi', $header) || !preg_match('/^[ \t*#@\/]*Text Domain:\s*amwscan\s*$/mi', $header) || !preg_match('/^[ \t*#@\/]*Version:\s*([0-9]+(?:\.[0-9]+){1,3}(?:-[A-Za-z0-9.-]+)?)\s*$/mi', $header, $match)) { return null; } return $match[1]; } /** * Replace synchronized engine source checksums with the matching plugin release source. */ protected static function withBundledPluginSource(array $manifest, $pluginVersion) { $url = 'https://codeload.github.com/marcocesarato/PHP-Antimalware-Scanner/zip/refs/tags/wordpress-v' . rawurlencode($pluginVersion); $archive = self::fetch($url, self::MAX_ARCHIVE_BYTES); if ($archive === false) { return $manifest; } $repositoryManifest = self::archiveManifest($archive); if (!is_array($repositoryManifest)) { return $manifest; } $sourceManifest = []; foreach ($repositoryManifest as $relativePath => $checksum) { if (strpos($relativePath, 'src/') === 0) { $sourceManifest[$relativePath] = $checksum; } } if (empty($sourceManifest)) { return $manifest; } foreach (array_keys($manifest) as $relativePath) { if (strpos($relativePath, 'src/') === 0) { unset($manifest[$relativePath]); } } return array_replace($manifest, $sourceManifest); } /** * @return array|null */ protected static function trustedDist($metadata, $package) { if (!is_array($metadata) || !isset($metadata['packages'][$package['name']]) || !is_array($metadata['packages'][$package['name']])) { return null; } $previousVersion = []; $isMinified = isset($metadata['minified']) && $metadata['minified'] === 'composer/2.0'; foreach ($metadata['packages'][$package['name']] as $version) { if ($isMinified && is_array($version)) { $version = array_replace($previousVersion, $version); $previousVersion = $version; } if (!is_array($version) || !isset($version['version']) || $version['version'] !== $package['version']) { continue; } $dist = isset($version['dist']) && is_array($version['dist']) ? $version['dist'] : []; if (empty($dist['url']) || empty($dist['type']) || strtolower($dist['type']) !== 'zip') { return null; } if (!self::isSafeUrl($dist['url'])) { return null; } $reference = isset($dist['reference']) ? (string)$dist['reference'] : ''; if ($package['dist-url'] === '' || !hash_equals($package['dist-url'], $dist['url'])) { return null; } if ($package['reference'] !== '' && !hash_equals($package['reference'], $reference)) { return null; } $shasum = isset($dist['shasum']) ? (string)$dist['shasum'] : ''; if ($package['dist-shasum'] !== '' && !hash_equals(strtolower($package['dist-shasum']), strtolower($shasum))) { return null; } return [ 'url' => $dist['url'], 'shasum' => $shasum, ]; } return null; } /** * @return array|false */ protected static function archiveManifest($archive) { if (!class_exists(\PharData::class)) { return false; } $tempBase = tempnam(sys_get_temp_dir(), 'amwscan-composer-'); if ($tempBase === false) { return false; } @unlink($tempBase); $tempFile = $tempBase . '.zip'; if (file_put_contents($tempFile, $archive, LOCK_EX) === false) { return false; } try { $phar = new \PharData($tempFile); $iterator = new \RecursiveIteratorIterator($phar); $prefix = 'phar://' . str_replace('\\', '/', $tempFile) . '/'; $manifest = []; $manifestKeys = []; $expandedBytes = 0; foreach ($iterator as $entry) { if (count($manifest) >= self::MAX_ARCHIVE_FILES) { return false; } if ($entry->isDir() || $entry->isLink()) { continue; } $entrySize = $entry->getSize(); if (!is_int($entrySize) || $entrySize < 0 || $entrySize > self::MAX_ENTRY_BYTES || $expandedBytes + $entrySize > self::MAX_EXPANDED_BYTES) { return false; } $entryPath = str_replace('\\', '/', $entry->getPathName()); if (strpos($entryPath, $prefix) !== 0) { return false; } $entryPath = substr($entryPath, strlen($prefix)); $manifestKey = DIRECTORY_SEPARATOR === '\\' ? strtolower($entryPath) : $entryPath; if (!self::isSafeArchivePath($entryPath) || isset($manifestKeys[$manifestKey])) { return false; } $manifestKeys[$manifestKey] = true; $stream = @fopen($entry->getPathName(), 'rb'); if ($stream === false) { return false; } $context = hash_init('sha256'); $readBytes = 0; while (!feof($stream)) { $chunk = fread($stream, 8192); if ($chunk === false) { fclose($stream); return false; } $readBytes += strlen($chunk); if ($readBytes > self::MAX_ENTRY_BYTES || $expandedBytes + $readBytes > self::MAX_EXPANDED_BYTES) { fclose($stream); return false; } hash_update($context, $chunk); } fclose($stream); if ($readBytes !== $entrySize) { return false; } $expandedBytes += $readBytes; $manifest[$entryPath] = hash_final($context); } $manifest = self::stripArchiveRoot($manifest); return empty($manifest) ? false : $manifest; } catch (\Throwable $exception) { return false; } finally { @unlink($tempFile); } } /** * @return array */ protected static function stripArchiveRoot($manifest) { $root = null; foreach (array_keys($manifest) as $path) { $separator = strpos($path, '/'); if ($separator === false) { return $manifest; } $currentRoot = substr($path, 0, $separator); if ($root === null) { $root = $currentRoot; } elseif ($root !== $currentRoot) { return $manifest; } } $stripped = []; foreach ($manifest as $path => $hash) { $relativePath = substr($path, strlen($root) + 1); if ($relativePath === '' || isset($stripped[$relativePath])) { return $manifest; } $stripped[$relativePath] = $hash; } return $stripped; } /** * @return string|false */ protected static function fetch($url, $maxBytes) { if (!self::isSafeUrl($url)) { return false; } if (self::$fetcher !== null) { if (self::$requests >= self::MAX_REQUESTS) { return false; } self::$requests++; $content = call_user_func(self::$fetcher, $url, $maxBytes); return is_string($content) && strlen($content) <= $maxBytes ? $content : false; } return self::fetchRemote($url, $maxBytes); } /** * @return string|false */ protected static function fetchRemote($url, $maxBytes, $redirects = 0) { if ($redirects > 3 || self::$requests >= self::MAX_REQUESTS || !self::isSafeRemoteUrl($url)) { return false; } self::$requests++; $context = stream_context_create([ 'http' => [ 'follow_location' => 0, 'ignore_errors' => true, 'timeout' => 10, 'user_agent' => 'PHP-Antimalware-Scanner Composer Verifier', ], 'ssl' => [ 'verify_peer' => true, 'verify_peer_name' => true, ], ]); $stream = @fopen($url, 'rb', false, $context); if ($stream === false) { return false; } $metadata = stream_get_meta_data($stream); $headers = isset($metadata['wrapper_data']) && is_array($metadata['wrapper_data']) ? $metadata['wrapper_data'] : []; $status = 0; if (isset($headers[0]) && preg_match('/\s(\d{3})(?:\s|$)/', $headers[0], $matches)) { $status = (int)$matches[1]; } if ($status >= 300 && $status < 400) { fclose($stream); $location = self::redirectLocation($headers); $redirectUrl = $location === null ? null : self::resolveRedirect($url, $location); return $redirectUrl === null ? false : self::fetchRemote($redirectUrl, $maxBytes, $redirects + 1); } if ($status >= 400) { fclose($stream); return false; } $content = ''; while (!feof($stream)) { $chunk = fread($stream, 8192); if ($chunk === false) { fclose($stream); return false; } $content .= $chunk; if (strlen($content) > $maxBytes) { fclose($stream); return false; } } fclose($stream); return $content; } /** * @return string|null */ protected static function redirectLocation($headers) { foreach ($headers as $header) { if (stripos($header, 'Location:') === 0) { return trim(substr($header, strlen('Location:'))); } } return null; } /** * @return string|null */ protected static function resolveRedirect($url, $location) { if (self::isSafeUrl($location)) { return $location; } $parts = parse_url($url); if (!is_array($parts) || !isset($parts['host'])) { return null; } $authority = 'https://' . $parts['host']; if (isset($parts['port'])) { $authority .= ':' . $parts['port']; } if (strpos($location, '//') === 0) { $candidate = 'https:' . $location; return self::isSafeUrl($candidate) ? $candidate : null; } if (strpos($location, '/') === 0) { $candidate = $authority . $location; return self::isSafeUrl($candidate) ? $candidate : null; } return null; } /** * @return bool */ protected static function isSafeUrl($url) { $parts = parse_url($url); return is_array($parts) && isset($parts['scheme'], $parts['host']) && strtolower($parts['scheme']) === 'https' && !isset($parts['user']) && !isset($parts['pass']); } /** * @return bool */ protected static function isSafeRemoteUrl($url) { if (!self::isSafeUrl($url)) { return false; } $parts = parse_url($url); if (isset($parts['port']) && (int)$parts['port'] !== 443) { return false; } $host = strtolower(trim($parts['host'], '[]')); if ($host === 'localhost' || substr($host, -10) === '.localhost' || substr($host, -6) === '.local') { return false; } if (filter_var($host, FILTER_VALIDATE_IP)) { return (bool)filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE); } $addresses = @gethostbynamel($host); if (!is_array($addresses) || empty($addresses)) { return false; } foreach ($addresses as $address) { if (!filter_var($address, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) { return false; } } return true; } /** * @return bool */ protected static function isSafeArchivePath($path) { if ($path === '' || strpos($path, "\0") !== false || substr($path, 0, 1) === '/' || preg_match('/^[A-Za-z]:/', $path)) { return false; } foreach (explode('/', $path) as $part) { if ($part === '' || $part === '.' || $part === '..') { return false; } } return true; } /** * @return bool */ protected static function isWithin($path, $root) { $path = rtrim($path, DIRECTORY_SEPARATOR); $root = rtrim($root, DIRECTORY_SEPARATOR); if (DIRECTORY_SEPARATOR === '\\') { $path = strtolower($path); $root = strtolower($root); } return $path === $root || strpos($path, $root . DIRECTORY_SEPARATOR) === 0; } /** * @return bool */ protected static function isValidManifest($manifest) { if (!is_array($manifest) || empty($manifest) || count($manifest) > self::MAX_ARCHIVE_FILES) { return false; } $keys = []; foreach ($manifest as $path => $hash) { if (!is_string($path) || !self::isSafeArchivePath($path) || !is_string($hash) || !preg_match('/^[a-f0-9]{64}$/', $hash)) { return false; } $key = DIRECTORY_SEPARATOR === '\\' ? strtolower($path) : $path; if (isset($keys[$key])) { return false; } $keys[$key] = true; } return true; } protected static function encodePackageName($name) { return implode('/', array_map('rawurlencode', explode('/', $name))); } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform; interface VerifierInterface { /** * Initialize path. */ public static function init($path); /** * Is verified file. */ public static function isVerified($path); } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform; interface ProcessApiProviderInterface { public function getClassTypes(); public function getTypeDetails(); public function getStaticReturnTypes(); public function getInstanceReturnTypes(); public function getFunctions(); public function allowsStaticTerminalCall($type, $method, array $arguments); public function allowsInstanceTerminalCall($type, $method, array $arguments, array $argumentTypes); } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform; use AMWScan\Detection\CodeMatch; use AMWScan\Platform\CakePHP\ProcessApiProvider as CakePHPProcessApiProvider; use AMWScan\Platform\CodeIgniter\ProcessApiProvider as CodeIgniterProcessApiProvider; use AMWScan\Platform\Drupal\ProcessApiProvider as DrupalProcessApiProvider; use AMWScan\Platform\Joomla\ProcessApiProvider as JoomlaProcessApiProvider; use AMWScan\Platform\Laravel\ProcessApiProvider as LaravelProcessApiProvider; use AMWScan\Platform\Magento\ProcessApiProvider as MagentoProcessApiProvider; use AMWScan\Platform\PrestaShop\ProcessApiProvider as PrestaShopProcessApiProvider; use AMWScan\Platform\Symfony\ProcessApiProvider as SymfonyProcessApiProvider; use AMWScan\Platform\TYPO3\ProcessApiProvider as TYPO3ProcessApiProvider; use AMWScan\Platform\WordPress\ProcessApiProvider as WordPressProcessApiProvider; use AMWScan\Platform\Yii\ProcessApiProvider as YiiProcessApiProvider; use AMWScan\Scan\SourceSizeAnalyzer; class ProcessDetector { private static $classTypes; private static $typeDetails; private static $staticReturnTypes; private static $instanceReturnTypes; private static $functions; private static $typeProviders; private const ASSIGNMENT_OPERATORS = [ '=', '+=', '-=', '*=', '/=', '.=', '%=', '&=', '|=', '^=', '<<=', '>>=', '**=', '??=', ]; public static function scan($content) { if ( !is_string($content) || $content === '' || strpos($content, ' $type) { if ($type === null) { unset($variables[$name]); } else { $variables[$name] = $type; } } $contexts[] = [ 'type' => 'function', 'variables' => $variables, 'arrowEnd' => $arrow['end'], 'start' => $index, ]; $index = $arrow['operator']; } continue; } if ($token['id'] === T_FUNCTION) { $signature = self::readFunctionSignature($tokens, $index, $imports, $namespace); if ($signature !== null) { $pendingFunction = $signature['variables']; $classIndex = self::contextIndex($contexts, 'class'); if ($classIndex !== null) { foreach ($signature['properties'] as $property => $type) { $contexts[$classIndex]['properties'][$property] = $type; } } $index = $signature['end']; } continue; } if ($token['text'] === '{') { $braceContexts[] = true; if ($pendingFunction !== null) { $contexts[] = [ 'type' => 'function', 'variables' => $pendingFunction, 'start' => $index, ]; $pendingFunction = null; } elseif ($pendingClass) { $contexts[] = ['type' => 'class', 'properties' => []]; $pendingClass = false; } else { $contexts[] = ['type' => 'block']; } continue; } if ($token['text'] === '}') { if (array_pop($braceContexts)) { array_pop($contexts); } continue; } if ($token['text'] === ';') { $pendingFunction = null; } if ($token['id'] === T_NEW) { self::scanNewExpression( $content, $tokens, $index, $imports, $namespace, $contexts, $globalVariables, $findings, $seen ); } if (self::isNameStart($tokens, $index)) { self::scanStaticCall( $content, $tokens, $index, $imports, $namespace, $contexts, $globalVariables, $findings, $seen ); self::scanKnownFunctionCall( $content, $tokens, $index, $namespace, $functionImports, $declaredFunctions, $contexts, $findings, $seen ); } if ($token['id'] !== T_VARIABLE) { continue; } $functionIndex = self::contextIndex($contexts, 'function'); $classIndex = self::contextIndex($contexts, 'class'); if ($classIndex !== null && $functionIndex === null) { $propertyType = self::readDeclaredType($tokens, $index, $imports, $namespace); if ($propertyType !== null) { $contexts[$classIndex]['properties'][substr($token['text'], 1)] = $propertyType; } continue; } self::scanTypedReceiver( $content, $tokens, $index, $imports, $namespace, $contexts, $globalVariables, $findings, $seen ); self::recordAssignment( $tokens, $index, $imports, $namespace, $contexts, $globalVariables ); } usort($findings, static function ($left, $right) { return $left['offset'] <=> $right['offset']; }); return $findings; } private static function initializeProviders() { if (self::$classTypes !== null) { return; } self::$classTypes = []; self::$typeDetails = []; self::$staticReturnTypes = []; self::$instanceReturnTypes = []; self::$functions = []; self::$typeProviders = []; $providers = [ new SymfonyProcessApiProvider(), new LaravelProcessApiProvider(), new WordPressProcessApiProvider(), new MagentoProcessApiProvider(), new DrupalProcessApiProvider(), new JoomlaProcessApiProvider(), new PrestaShopProcessApiProvider(), new TYPO3ProcessApiProvider(), new CodeIgniterProcessApiProvider(), new YiiProcessApiProvider(), new CakePHPProcessApiProvider(), ]; foreach ($providers as $provider) { self::$classTypes = array_merge(self::$classTypes, $provider->getClassTypes()); self::$staticReturnTypes = array_merge(self::$staticReturnTypes, $provider->getStaticReturnTypes()); self::$instanceReturnTypes = array_merge(self::$instanceReturnTypes, $provider->getInstanceReturnTypes()); self::$functions = array_merge(self::$functions, $provider->getFunctions()); foreach ($provider->getTypeDetails() as $type => $details) { self::$typeDetails[$type] = $details; self::$typeProviders[$type] = $provider; } } } private static function tokenize($content) { try { $rawTokens = token_get_all($content); } catch (\Throwable $exception) { return []; } $tokens = []; $offset = 0; $line = 1; foreach ($rawTokens as $index => $rawToken) { unset($rawTokens[$index]); if (is_array($rawToken)) { $id = $rawToken[0]; $text = $rawToken[1]; $tokenLine = $rawToken[2]; } else { $id = null; $text = $rawToken; $tokenLine = $line; } if (!in_array($id, [T_WHITESPACE, T_COMMENT, T_DOC_COMMENT, T_OPEN_TAG, T_CLOSE_TAG, T_INLINE_HTML], true)) { $tokens[] = [ 'id' => $id, 'text' => $text, 'line' => $tokenLine, 'offset' => $offset, ]; } $offset += strlen($text); $line += substr_count($text, "\n"); } return $tokens; } private static function declaredFunctions(array $tokens) { $functions = []; $namespace = ''; $classDepth = 0; $pendingClass = false; $braces = []; $count = count($tokens); for ($index = 0; $index < $count; $index++) { $token = $tokens[$index]; if ($token['id'] === T_NAMESPACE) { list($namespace) = self::readNamespace($tokens, $index); continue; } if (in_array($token['id'], [T_CURLY_OPEN, T_DOLLAR_OPEN_CURLY_BRACES], true)) { $braces[] = false; continue; } if (in_array($token['id'], [T_CLASS, T_INTERFACE, T_TRAIT], true) && (!isset($tokens[$index - 1]) || $tokens[$index - 1]['text'] !== '::')) { $pendingClass = true; continue; } if ($token['text'] === '{') { $braces[] = $pendingClass; if ($pendingClass) { $classDepth++; $pendingClass = false; } continue; } if ($token['text'] === '}') { if (array_pop($braces)) { $classDepth--; } continue; } if ($token['id'] !== T_FUNCTION || $classDepth > 0 || (isset($tokens[$index - 1]) && $tokens[$index - 1]['id'] === T_USE)) { continue; } for ($cursor = $index + 1; $cursor < $count; $cursor++) { if ($tokens[$cursor]['text'] === '&') { continue; } if ($tokens[$cursor]['id'] === T_STRING) { $name = ltrim($namespace . '\\' . $tokens[$cursor]['text'], '\\'); $functions[strtolower($name)] = true; } break; } } return $functions; } private static function captureClosureVariables( array $tokens, $open, $close, array $contexts, array $globalVariables, array &$variables ) { for ($index = $open + 1; $index < $close; $index++) { if ($tokens[$index]['id'] !== T_VARIABLE) { continue; } $name = substr($tokens[$index]['text'], 1); $type = self::variableType($name, $contexts, $globalVariables); if ($type === null) { unset($variables[$name]); } else { $variables[$name] = $type; } } } private static function readNamespace(array $tokens, $index) { $name = ''; $count = count($tokens); for ($cursor = $index + 1; $cursor < $count; $cursor++) { if ($tokens[$cursor]['text'] === ';' || $tokens[$cursor]['text'] === '{') { return [trim($name, '\\'), $cursor]; } if (self::isNameToken($tokens[$cursor])) { $name .= $tokens[$cursor]['text']; } } return ['', null]; } private static function readImports(array $tokens, $index, array &$imports, array &$functionImports) { $clause = ''; $count = count($tokens); for ($cursor = $index + 1; $cursor < $count; $cursor++) { if ($tokens[$cursor]['text'] === ';') { self::parseImportClause($clause, $imports, $functionImports); return $cursor; } if ($tokens[$cursor]['id'] === T_AS) { $clause .= ' as '; } elseif ($tokens[$cursor]['id'] === T_FUNCTION) { $clause .= 'function '; } elseif ($tokens[$cursor]['id'] === T_CONST) { $clause .= 'const '; } else { $clause .= $tokens[$cursor]['text']; } } return null; } private static function parseImportClause($clause, array &$imports, array &$functionImports) { $clause = trim($clause); if ($clause === '' || preg_match('/^const\b/i', $clause)) { return; } if (preg_match('/^function\b(.*)$/i', $clause, $functionClause)) { self::parseFunctionImportClause(trim($functionClause[1]), $functionImports); return; } if (preg_match('/^(.+?)\\\\\{(.+)\}$/', $clause, $group)) { $prefix = rtrim($group[1], '\\'); foreach (explode(',', $group[2]) as $member) { self::addImport($prefix . '\\' . trim($member), $imports); } return; } foreach (explode(',', $clause) as $import) { self::addImport(trim($import), $imports); } } private static function parseFunctionImportClause($clause, array &$functionImports) { if (preg_match('/^(.+?)\\\\\{(.+)\}$/', $clause, $group)) { $prefix = rtrim($group[1], '\\'); foreach (explode(',', $group[2]) as $member) { self::addFunctionImport($prefix . '\\' . trim($member), $functionImports); } return; } foreach (explode(',', $clause) as $import) { self::addFunctionImport(trim($import), $functionImports); } } private static function addFunctionImport($import, array &$functionImports) { if (!preg_match('/^(.+?)(?:\s+as\s+([a-z_][a-z0-9_]*))?$/i', $import, $match)) { return; } $function = trim($match[1], '\\'); if ($function === '') { return; } $parts = explode('\\', $function); $alias = isset($match[2]) && $match[2] !== '' ? $match[2] : end($parts); $functionImports[strtolower($alias)] = strtolower($function); } private static function addImport($import, array &$imports) { if (!preg_match('/^(.+?)(?:\s+as\s+([a-z_][a-z0-9_]*))?$/i', $import, $match)) { return; } $class = trim($match[1], '\\'); if ($class === '') { return; } $parts = explode('\\', $class); $alias = isset($match[2]) && $match[2] !== '' ? $match[2] : end($parts); $imports[strtolower($alias)] = $class; } private static function readFunctionSignature(array $tokens, $index, array $imports, $namespace) { $open = self::findToken($tokens, $index + 1, '('); if ($open === null) { return null; } $close = self::findMatching($tokens, $open, '(', ')'); if ($close === null) { return null; } $variables = []; $parameters = []; $properties = []; foreach (self::argumentRanges($tokens, $open, $close) as $range) { $variableIndex = null; $promoted = false; for ($cursor = $range[0]; $cursor <= $range[1]; $cursor++) { if ($tokens[$cursor]['id'] === T_VARIABLE) { $variableIndex = $cursor; break; } if (in_array($tokens[$cursor]['id'], [T_PUBLIC, T_PROTECTED, T_PRIVATE], true)) { $promoted = true; } } if ($variableIndex === null) { continue; } $name = substr($tokens[$variableIndex]['text'], 1); $type = self::readDeclaredType($tokens, $variableIndex, $imports, $namespace, $range[0]); $parameters[$name] = $type; if ($type === null) { continue; } $variables[$name] = $type; if ($promoted) { $properties[$name] = $type; } } return [ 'variables' => $variables, 'parameters' => $parameters, 'properties' => $properties, 'end' => $close, ]; } private static function readArrowExpression(array $tokens, $signatureEnd) { $count = count($tokens); for ($operator = $signatureEnd + 1; $operator < $count; $operator++) { if ($tokens[$operator]['id'] === T_DOUBLE_ARROW) { break; } if (in_array($tokens[$operator]['text'], [';', '{', '}'], true)) { return null; } } if ($operator >= $count) { return null; } $depth = 0; for ($index = $operator + 1; $index < $count; $index++) { $text = $tokens[$index]['text']; if (in_array($text, ['(', '[', '{'], true)) { $depth++; } elseif (in_array($text, [')', ']', '}'], true)) { if ($depth === 0) { break; } $depth--; } elseif ($depth === 0 && in_array($text, [',', ';'], true)) { break; } } return ['operator' => $operator, 'end' => $index - 1]; } private static function readDeclaredType(array $tokens, $variableIndex, array $imports, $namespace, $lowerBound = null) { $lowerBound = $lowerBound === null ? self::statementStart($tokens, $variableIndex) : $lowerBound; $cursor = $variableIndex - 1; while ($cursor >= $lowerBound && in_array($tokens[$cursor]['text'], ['&', '...'], true)) { $cursor--; } $end = $cursor; while ($cursor >= $lowerBound && (self::isNameToken($tokens[$cursor]) || in_array($tokens[$cursor]['text'], ['\\', '?'], true))) { $cursor--; } if ($end < $cursor + 1) { return null; } for ($check = $lowerBound; $check <= $end; $check++) { if (in_array($tokens[$check]['text'], ['|', '&'], true)) { return null; } } $typeName = ''; for ($part = $cursor + 1; $part <= $end; $part++) { $typeName .= $tokens[$part]['text']; } $typeName = ltrim($typeName, '?'); return self::resolveType($typeName, $imports, $namespace); } private static function statementStart(array $tokens, $index) { for ($cursor = $index - 1; $cursor >= 0; $cursor--) { if (in_array($tokens[$cursor]['text'], [';', '{', '}', '(', ','], true)) { return $cursor + 1; } } return 0; } private static function scanNewExpression( $content, array $tokens, $index, array $imports, $namespace, array $contexts, array $globalVariables, array &$findings, array &$seen ) { $className = self::readName($tokens, $index + 1); if ($className === null) { return; } $type = self::resolveType($className['name'], $imports, $namespace); if ($type === null || !isset(self::$typeDetails[$type])) { return; } $open = isset($tokens[$className['end'] + 1]) && $tokens[$className['end'] + 1]['text'] === '(' ? $className['end'] + 1 : null; if ($open === null) { return; } $close = self::findMatching($tokens, $open, '(', ')'); if ($close === null) { return; } $chainStart = $close + 1; if (isset($tokens[$chainStart]) && $tokens[$chainStart]['text'] === ')' && self::isGroupedNewExpression($tokens, $index)) { $chainStart++; } self::scanTerminalChain( $content, $tokens, $chainStart, $type, $index, $imports, $namespace, $contexts, $globalVariables, $findings, $seen ); } private static function scanStaticCall( $content, array $tokens, $index, array $imports, $namespace, array $contexts, array $globalVariables, array &$findings, array &$seen ) { $className = self::readName($tokens, $index); if ($className === null || !isset($tokens[$className['end'] + 3]) || $tokens[$className['end'] + 1]['text'] !== '::' || $tokens[$className['end'] + 3]['text'] !== '(') { return; } $type = self::resolveType($className['name'], $imports, $namespace); if ($type === null) { return; } $methodIndex = $className['end'] + 2; $method = strtolower($tokens[$methodIndex]['text']); $open = $className['end'] + 3; $close = self::findMatching($tokens, $open, '(', ')'); if ($close === null) { return; } $details = isset(self::$typeDetails[$type]) ? self::$typeDetails[$type] : null; if ($details !== null && in_array($method, $details['staticTerminals'], true) && self::$typeProviders[$type]->allowsStaticTerminalCall( $type, $method, self::argumentTexts($tokens, $open, $close) )) { self::addFinding( $content, $tokens, $details['platform'], $details['api'], $tokens[$methodIndex]['text'], $index, $methodIndex, $close, $findings, $seen, self::scopeStart($contexts) ); return; } $factoryType = self::staticReturnType($type, $method); if ($factoryType !== null) { self::scanTerminalChain( $content, $tokens, $close + 1, $factoryType, $index, $imports, $namespace, $contexts, $globalVariables, $findings, $seen ); } } private static function scanKnownFunctionCall( $content, array $tokens, $index, $namespace, array $functionImports, array $declaredFunctions, array $contexts, array &$findings, array &$seen ) { $functionName = self::readName($tokens, $index); if ($functionName === null || !isset($tokens[$functionName['end'] + 1])) { return; } $writtenName = $functionName['name']; $normalizedName = strtolower(ltrim($writtenName, '\\')); $shortNameParts = explode('\\', $normalizedName); $shortName = end($shortNameParts); if (!isset(self::$functions[$shortName]) || $tokens[$functionName['end'] + 1]['text'] !== '(') { return; } $previous = isset($tokens[$index - 1]) ? $tokens[$index - 1]['text'] : ''; if (in_array($previous, ['->', '?->', '::'], true)) { return; } $fullyQualified = isset($writtenName[0]) && $writtenName[0] === '\\'; if (!$fullyQualified) { if (isset($functionImports[$shortName])) { if ($functionImports[$shortName] !== $shortName) { return; } } elseif ($namespace !== '') { return; } } elseif ($normalizedName !== $shortName) { return; } if (isset($declaredFunctions[$shortName])) { return; } $open = $functionName['end'] + 1; $close = self::findMatching($tokens, $open, '(', ')'); if ($close !== null) { $details = self::$functions[$shortName]; self::addFinding( $content, $tokens, $details['platform'], $details['api'], $shortName, $index, $functionName['end'], $close, $findings, $seen, self::scopeStart($contexts) ); } } private static function scanTypedReceiver( $content, array $tokens, $index, array $imports, $namespace, array &$contexts, array &$globalVariables, array &$findings, array &$seen ) { $receiver = self::receiverAt($tokens, $index); if ($receiver === null) { return; } $type = null; if ($receiver['kind'] === 'variable') { $type = self::variableType($receiver['name'], $contexts, $globalVariables); } else { $classIndex = self::contextIndex($contexts, 'class'); if ($classIndex !== null && isset($contexts[$classIndex]['properties'][$receiver['name']])) { $type = $contexts[$classIndex]['properties'][$receiver['name']]; } } if ($type === null) { return; } $method = strtolower($tokens[$receiver['method']]['text']); $open = $receiver['method'] + 1; $close = self::findMatching($tokens, $open, '(', ')'); if ($close === null) { return; } if (isset(self::$typeDetails[$type]) && in_array($method, self::$typeDetails[$type]['instanceTerminals'], true) && self::$typeProviders[$type]->allowsInstanceTerminalCall( $type, $method, self::argumentTexts($tokens, $open, $close), self::argumentTypes($tokens, $open, $close, $imports, $namespace, $contexts, $globalVariables) )) { $details = self::$typeDetails[$type]; self::addFinding( $content, $tokens, $details['platform'], $details['api'], $tokens[$receiver['method']]['text'], $index, $receiver['method'], $close, $findings, $seen, self::scopeStart($contexts) ); return; } $factoryType = self::instanceReturnType($type, $method); if ($factoryType !== null) { self::scanTerminalChain( $content, $tokens, $close + 1, $factoryType, $index, $imports, $namespace, $contexts, $globalVariables, $findings, $seen ); } } private static function receiverAt(array $tokens, $index) { if (!isset($tokens[$index + 3])) { return null; } if ($tokens[$index]['text'] === '$this' && in_array($tokens[$index + 1]['text'], ['->', '?->'], true) && $tokens[$index + 2]['id'] === T_STRING && isset($tokens[$index + 5]) && in_array($tokens[$index + 3]['text'], ['->', '?->'], true) && $tokens[$index + 4]['id'] === T_STRING && $tokens[$index + 5]['text'] === '(') { return ['kind' => 'property', 'name' => $tokens[$index + 2]['text'], 'method' => $index + 4]; } if ($tokens[$index]['text'] !== '$this' && in_array($tokens[$index + 1]['text'], ['->', '?->'], true) && $tokens[$index + 2]['id'] === T_STRING && $tokens[$index + 3]['text'] === '(') { return ['kind' => 'variable', 'name' => substr($tokens[$index]['text'], 1), 'method' => $index + 2]; } return null; } private static function recordAssignment( array $tokens, $index, array $imports, $namespace, array &$contexts, array &$globalVariables ) { if ($tokens[$index]['text'] === '$this' && isset($tokens[$index + 4]) && in_array($tokens[$index + 1]['text'], ['->', '?->'], true) && $tokens[$index + 2]['id'] === T_STRING && in_array($tokens[$index + 3]['text'], self::ASSIGNMENT_OPERATORS, true)) { $type = $tokens[$index + 3]['text'] === '=' ? self::inferExpressionType($tokens, $index + 4, $imports, $namespace, $contexts, $globalVariables) : null; $classIndex = self::contextIndex($contexts, 'class'); if ($classIndex !== null) { $property = $tokens[$index + 2]['text']; if ($type === null) { unset($contexts[$classIndex]['properties'][$property]); } else { $contexts[$classIndex]['properties'][$property] = $type; } } return; } if ($tokens[$index]['text'] === '$this') { return; } $name = substr($tokens[$index]['text'], 1); if (isset($tokens[$index + 1]) && in_array($tokens[$index + 1]['text'], self::ASSIGNMENT_OPERATORS, true)) { $type = $tokens[$index + 1]['text'] === '=' ? self::inferExpressionType($tokens, $index + 2, $imports, $namespace, $contexts, $globalVariables) : null; self::setVariableType($name, $type, $contexts, $globalVariables); return; } if (self::isUnknownVariableBinding($tokens, $index)) { self::setVariableType($name, null, $contexts, $globalVariables); } } private static function isUnknownVariableBinding(array $tokens, $index) { $owner = self::enclosingParenthesisOwner($tokens, $index); if ($owner !== null) { if ($tokens[$owner]['id'] === T_CATCH || $tokens[$owner]['id'] === T_UNSET) { return true; } if ($tokens[$owner]['id'] === T_FOREACH) { for ($cursor = $owner + 2; $cursor < $index; $cursor++) { if ($tokens[$cursor]['id'] === T_AS) { return true; } } } if ($tokens[$owner]['id'] === T_LIST) { $close = self::findMatching($tokens, $owner + 1, '(', ')'); return $close !== null && isset($tokens[$close + 1]) && $tokens[$close + 1]['text'] === '='; } } $statementStart = self::statementStart($tokens, $index); for ($cursor = $statementStart; $cursor < $index; $cursor++) { if ($tokens[$cursor]['id'] === T_GLOBAL || $tokens[$cursor]['id'] === T_STATIC) { return true; } } return self::isDestructuredVariable($tokens, $index); } private static function enclosingParenthesisOwner(array $tokens, $index) { $depth = 0; for ($cursor = $index - 1; $cursor >= 0; $cursor--) { if ($tokens[$cursor]['text'] === ')') { $depth++; } elseif ($tokens[$cursor]['text'] === '(') { if ($depth === 0) { return $cursor > 0 ? $cursor - 1 : null; } $depth--; } elseif ($depth === 0 && in_array($tokens[$cursor]['text'], [';', '{', '}'], true)) { return null; } } return null; } private static function isDestructuredVariable(array $tokens, $index) { $depth = 0; for ($cursor = $index - 1; $cursor >= 0; $cursor--) { if ($tokens[$cursor]['text'] === ']') { $depth++; continue; } if ($tokens[$cursor]['text'] !== '[') { if ($depth === 0 && in_array($tokens[$cursor]['text'], [';', '{', '}'], true)) { return false; } continue; } if ($depth > 0) { $depth--; continue; } $previous = isset($tokens[$cursor - 1]) ? $tokens[$cursor - 1] : null; if ($previous !== null && $previous['id'] !== T_AS && !in_array($previous['text'], [';', '{', '}', '(', '[', ',', '=', '=>'], true)) { return false; } $close = self::findMatching($tokens, $cursor, '[', ']'); if ($close !== null && $close > $index && isset($tokens[$close + 1]) && $tokens[$close + 1]['text'] === '=') { return true; } } return false; } private static function inferExpressionType( array $tokens, $index, array $imports, $namespace, array $contexts, array $globalVariables, $expressionEnd = null ) { $groupClosings = 0; while (isset($tokens[$index]) && $tokens[$index]['text'] === '(') { $groupClosings++; $index++; } if (!isset($tokens[$index])) { return null; } if ($tokens[$index]['id'] === T_NEW) { $className = self::readName($tokens, $index + 1); if ($className === null || !isset($tokens[$className['end'] + 1]) || $tokens[$className['end'] + 1]['text'] !== '(') { return null; } $close = self::findMatching($tokens, $className['end'] + 1, '(', ')'); $type = self::resolveType($className['name'], $imports, $namespace); return $close === null ? null : self::chainedExpressionType($tokens, $close + 1, $type, $expressionEnd, $groupClosings); } if ($tokens[$index]['id'] === T_VARIABLE) { if ($tokens[$index]['text'] === '$this' && isset($tokens[$index + 2]) && in_array($tokens[$index + 1]['text'], ['->', '?->'], true)) { $classIndex = self::contextIndex($contexts, 'class'); $type = $classIndex !== null && isset($contexts[$classIndex]['properties'][$tokens[$index + 2]['text']]) ? $contexts[$classIndex]['properties'][$tokens[$index + 2]['text']] : null; return self::chainedExpressionType( $tokens, $index + 3, $type, $expressionEnd, $groupClosings ); } $type = self::variableType(substr($tokens[$index]['text'], 1), $contexts, $globalVariables); return self::chainedExpressionType( $tokens, $index + 1, $type, $expressionEnd, $groupClosings ); } if (self::isNameStart($tokens, $index)) { $className = self::readName($tokens, $index); if ($className === null || !isset($tokens[$className['end'] + 3]) || $tokens[$className['end'] + 1]['text'] !== '::' || $tokens[$className['end'] + 3]['text'] !== '(') { return null; } $close = self::findMatching($tokens, $className['end'] + 3, '(', ')'); if ($close === null) { return null; } $type = self::resolveType($className['name'], $imports, $namespace); $method = strtolower($tokens[$className['end'] + 2]['text']); $type = self::staticReturnType($type, $method); return self::chainedExpressionType( $tokens, $close + 1, $type, $expressionEnd, $groupClosings ); } return null; } private static function chainedExpressionType( array $tokens, $index, $type, $expressionEnd = null, $groupClosings = 0 ) { while ($type !== null) { while ($groupClosings > 0 && isset($tokens[$index]) && $tokens[$index]['text'] === ')') { $groupClosings--; $index++; } if (!isset($tokens[$index]) || !in_array($tokens[$index]['text'], ['->', '?->'], true)) { if ($groupClosings > 0) { return null; } if ($expressionEnd !== null) { return $index > $expressionEnd ? $type : null; } return !isset($tokens[$index]) || in_array($tokens[$index]['text'], [',', ';', ')', ']', '}'], true) ? $type : null; } if (!isset($tokens[$index + 2]) || $tokens[$index + 2]['text'] !== '(') { return null; } $method = strtolower($tokens[$index + 1]['text']); if (isset(self::$typeDetails[$type]) && in_array($method, self::$typeDetails[$type]['instanceTerminals'], true)) { return null; } $close = self::findMatching($tokens, $index + 2, '(', ')'); if ($close === null || ($expressionEnd !== null && $close > $expressionEnd)) { return null; } $type = self::instanceReturnType($type, $method); $index = $close + 1; } return null; } private static function staticReturnType($type, $method) { return isset(self::$staticReturnTypes[$type][$method]) ? self::$staticReturnTypes[$type][$method] : null; } private static function instanceReturnType($type, $method) { return isset(self::$instanceReturnTypes[$type][$method]) ? self::$instanceReturnTypes[$type][$method] : null; } private static function scanTerminalChain( $content, array $tokens, $index, $type, $start, array $imports, $namespace, array $contexts, array $globalVariables, array &$findings, array &$seen ) { while (isset(self::$typeDetails[$type], $tokens[$index + 2]) && in_array($tokens[$index]['text'], ['->', '?->'], true) && $tokens[$index + 2]['text'] === '(') { $methodIndex = $index + 1; $method = strtolower($tokens[$methodIndex]['text']); $close = self::findMatching($tokens, $index + 2, '(', ')'); if ($close === null) { return; } if (in_array($method, self::$typeDetails[$type]['instanceTerminals'], true) && self::$typeProviders[$type]->allowsInstanceTerminalCall( $type, $method, self::argumentTexts($tokens, $index + 2, $close), self::argumentTypes( $tokens, $index + 2, $close, $imports, $namespace, $contexts, $globalVariables ) )) { $details = self::$typeDetails[$type]; self::addFinding( $content, $tokens, $details['platform'], $details['api'], $tokens[$methodIndex]['text'], $start, $methodIndex, $close, $findings, $seen, self::scopeStart($contexts) ); return; } $type = self::instanceReturnType($type, $method); if ($type === null) { return; } $index = $close + 1; } } private static function argumentTexts(array $tokens, $open, $close) { $arguments = []; foreach (self::argumentRanges($tokens, $open, $close) as $range) { $argument = ''; for ($index = $range[0]; $index <= $range[1]; $index++) { $argument .= $tokens[$index]['text']; } $arguments[] = $argument; } return $arguments; } private static function argumentTypes( array $tokens, $open, $close, array $imports, $namespace, array $contexts, array $globalVariables ) { $types = []; foreach (self::argumentRanges($tokens, $open, $close) as $range) { $types[] = self::inferExpressionType( $tokens, $range[0], $imports, $namespace, $contexts, $globalVariables, $range[1] ); } return $types; } private static function argumentRanges(array $tokens, $open, $close) { if ($close === $open + 1) { return []; } $ranges = []; $start = $open + 1; $depth = 0; for ($index = $start; $index < $close; $index++) { if (in_array($tokens[$index]['text'], ['(', '[', '{'], true)) { $depth++; } elseif (in_array($tokens[$index]['text'], [')', ']', '}'], true)) { $depth--; } elseif ($tokens[$index]['text'] === ',' && $depth === 0) { if ($start < $index) { $ranges[] = [$start, $index - 1]; } $start = $index + 1; } } if ($start < $close) { $ranges[] = [$start, $close - 1]; } return $ranges; } private static function resolveType($className, array $imports, $namespace) { if (!is_string($className) || $className === '') { return null; } $fullyQualified = $className[0] === '\\'; $className = ltrim($className, '\\'); $parts = explode('\\', $className); $alias = strtolower($parts[0]); if (isset($imports[$alias])) { array_shift($parts); $className = $imports[$alias] . (empty($parts) ? '' : '\\' . implode('\\', $parts)); } elseif (!$fullyQualified && $namespace !== '') { return null; } $normalized = strtolower($className); return isset(self::$classTypes[$normalized]) ? self::$classTypes[$normalized] : null; } private static function readName(array $tokens, $index) { if (!isset($tokens[$index]) || !self::isNameToken($tokens[$index])) { return null; } $name = ''; $count = count($tokens); for ($cursor = $index; $cursor < $count && self::isNameToken($tokens[$cursor]); $cursor++) { $name .= $tokens[$cursor]['text']; } return ['name' => $name, 'end' => $cursor - 1]; } private static function isNameStart(array $tokens, $index) { if (!self::isNameToken($tokens[$index])) { return false; } return $index === 0 || !self::isNameToken($tokens[$index - 1]); } private static function isNameToken(array $token) { if ($token['text'] === '\\') { return true; } if ($token['id'] === null) { return false; } return in_array(token_name($token['id']), [ 'T_STRING', 'T_NS_SEPARATOR', 'T_NAME_QUALIFIED', 'T_NAME_FULLY_QUALIFIED', 'T_NAME_RELATIVE', ], true); } private static function isClassConstant(array $tokens, $index) { return isset($tokens[$index - 1]) && $tokens[$index - 1]['text'] === '::'; } private static function isGroupedNewExpression(array $tokens, $index) { if (!isset($tokens[$index - 1]) || $tokens[$index - 1]['text'] !== '(') { return false; } if (!isset($tokens[$index - 2])) { return true; } $previous = $tokens[$index - 2]; return !self::isNameToken($previous) && $previous['id'] !== T_VARIABLE && !in_array($previous['text'], [')', ']', '}'], true); } private static function findToken(array $tokens, $index, $text) { $count = count($tokens); for ($cursor = $index; $cursor < $count; $cursor++) { if ($tokens[$cursor]['text'] === $text) { return $cursor; } if (in_array($tokens[$cursor]['text'], [';', '{'], true)) { return null; } } return null; } private static function findMatching(array $tokens, $open, $opening, $closing) { $depth = 0; $count = count($tokens); for ($index = $open; $index < $count; $index++) { if ($tokens[$index]['text'] === $opening) { $depth++; } elseif ($tokens[$index]['text'] === $closing && --$depth === 0) { return $index; } } return null; } private static function contextIndex(array $contexts, $type) { for ($index = count($contexts) - 1; $index >= 0; $index--) { if ($contexts[$index]['type'] === $type) { return $index; } } return null; } private static function closeArrowContexts(array &$contexts, $tokenIndex) { while (($functionIndex = self::contextIndex($contexts, 'function')) !== null && isset($contexts[$functionIndex]['arrowEnd']) && $contexts[$functionIndex]['arrowEnd'] < $tokenIndex) { array_splice($contexts, $functionIndex, 1); } } private static function scopeStart(array $contexts) { $functionIndex = self::contextIndex($contexts, 'function'); return $functionIndex === null ? 0 : $contexts[$functionIndex]['start']; } private static function visibleVariableTypes(array $contexts, array $globalVariables) { $functionIndex = self::contextIndex($contexts, 'function'); return $functionIndex === null ? $globalVariables : $contexts[$functionIndex]['variables']; } private static function variableType($name, array $contexts, array $globalVariables) { $functionIndex = self::contextIndex($contexts, 'function'); if ($functionIndex !== null) { return isset($contexts[$functionIndex]['variables'][$name]) ? $contexts[$functionIndex]['variables'][$name] : null; } return isset($globalVariables[$name]) ? $globalVariables[$name] : null; } private static function setVariableType($name, $type, array &$contexts, array &$globalVariables) { $functionIndex = self::contextIndex($contexts, 'function'); if ($functionIndex !== null) { if ($type === null) { unset($contexts[$functionIndex]['variables'][$name]); } else { $contexts[$functionIndex]['variables'][$name] = $type; } return; } if ($type === null) { unset($globalVariables[$name]); } else { $globalVariables[$name] = $type; } } private static function addFinding( $content, array $tokens, $platform, $api, $method, $start, $methodIndex, $end, array &$findings, array &$seen, $scopeStart ) { $offset = $tokens[$methodIndex]['offset']; $identity = strtolower($platform . '|' . $method . '|' . $offset); if (isset($seen[$identity])) { return; } $seen[$identity] = true; $startOffset = $tokens[$start]['offset']; $endOffset = $tokens[$end]['offset'] + strlen($tokens[$end]['text']); $match = substr($content, $startOffset, $endOffset - $startOffset); $threat = ProcessCommandAnalyzer::analyze( $tokens, $api, $method, $start, $methodIndex, $end, $scopeStart ); $key = $threat === null ? 'framework_process_' . preg_replace('/[^a-z0-9]+/', '_', strtolower($platform)) : 'malicious_process_' . $threat['key']; $description = $threat === null ? sprintf( 'Potential %s process execution through %s::%s(); verify that command arguments cannot be controlled by untrusted input.', $platform, $api, $method ) : sprintf( 'High-risk %s detected in confirmed %s process execution through %s::%s(); investigate the command and its source.', $threat['label'], $platform, $api, $method ); $finding = [ 'key' => trim($key, '_'), 'level' => $threat === null ? CodeMatch::WARNING : CodeMatch::DANGEROUS, 'description' => $description, 'line' => $tokens[$methodIndex]['line'], 'offset' => $offset, 'match' => $match, 'platform' => $platform, 'api' => $api, 'method' => $method, ]; if ($threat !== null) { $finding['threat'] = $threat['key']; } $findings[] = $finding; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\Magento; use AMWScan\Platform\ProcessApiProviderAbstract; class ProcessApiProvider extends ProcessApiProviderAbstract { private const SHELL_TYPE = 'magento-shell'; public function getClassTypes() { return [ 'magento\\framework\\shellinterface' => self::SHELL_TYPE, 'magento\\framework\\shell' => self::SHELL_TYPE, 'magento\\framework\\shell\\driver' => self::SHELL_TYPE, ]; } public function getTypeDetails() { return [ self::SHELL_TYPE => [ 'platform' => 'Magento', 'api' => 'Magento shell', 'instanceTerminals' => ['execute'], 'staticTerminals' => [], ], ]; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\Magento; use AMWScan\Platform\RepositoryVerifier; class Verifier extends RepositoryVerifier { protected static $roots = []; public static function isRoot($path) { return is_dir($path) && is_file($path . DIRECTORY_SEPARATOR . 'composer.json') && is_file($path . DIRECTORY_SEPARATOR . 'bin' . DIRECTORY_SEPARATOR . 'magento') && is_file($path . DIRECTORY_SEPARATOR . 'app' . DIRECTORY_SEPARATOR . 'etc' . DIRECTORY_SEPARATOR . 'NonComposerComponentRegistration.php'); } public static function getVersion($root) { $composer = static::readJson($root . DIRECTORY_SEPARATOR . 'composer.json'); if (isset($composer['name'], $composer['version']) && $composer['name'] === 'magento/magento2ce' && static::isVersion($composer['version'])) { return $composer['version']; } $lock = static::readJson($root . DIRECTORY_SEPARATOR . 'composer.lock'); $packageNames = [ 'magento/product-community-edition', 'magento/product-enterprise-edition', 'magento/magento2-base', ]; foreach ($lock['packages'] ?? [] as $package) { if (isset($package['name'], $package['version']) && in_array($package['name'], $packageNames, true) && static::isVersion($package['version'])) { return $package['version']; } } return null; } protected static function getPlatformName() { return 'Magento'; } protected static function getRepository() { return 'magento/magento2'; } private static function readJson($file) { $content = is_file($file) ? @file_get_contents($file) : false; if ($content === false) { return []; } $data = json_decode($content, true); return json_last_error() === JSON_ERROR_NONE && is_array($data) ? $data : []; } private static function isVersion($version) { return is_string($version) && preg_match('/^[0-9][0-9A-Za-z.\-]*$/', $version) === 1; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform; class ProcessCommandAnalyzer { private const MAX_ASSIGNMENT_DEPTH = 4; private const MAX_COMMAND_LENGTH = 8192; private const COMMAND_CARRIERS = [ 'command', 'create', 'drush', 'fromshellcommandline', 'process', 'shell', 'siteprocess', ]; private const THREATS = [ 'download_execution' => [ 'label' => 'download-to-interpreter pipeline', 'patterns' => [ '~\b(?:curl|wget)\b.{0,600}\|\s*(?:(?:/usr)?/bin/)?(?:ba|da|z|k)?sh\b~is', '~\b(?:invoke-webrequest|iwr|curl)\b.{0,600}\|\s*(?:invoke-expression|iex)\b~is', ], ], 'encoded_execution' => [ 'label' => 'encoded interpreter execution', 'patterns' => [ '~\b(?:powershell|pwsh)(?:\.exe)?\b.{0,160}\s-(?:e|enc|encodedcommand)\s+[a-z0-9+/=]{12,}~is', '~\b(?:base64\s+(?:--decode|-d)|base64_decode)\b.{0,400}(?:\||;|&&).{0,100}\b(?:ba|da|z|k)?sh\b~is', '~\b(?:php|python|perl|ruby)\b.{0,80}\s-(?:r|c|e)\s+.{0,400}\b(?:base64_decode|b64decode|decode_base64)\b~is', ], ], 'reverse_shell' => [ 'label' => 'reverse-shell construction', 'patterns' => [ '~\b(?:ba|da|z|k)?sh\b.{0,160}(?:-i\b.{0,120})?>\s*&?\s*/dev/tcp/~is', '~\b(?:nc|ncat|netcat)\b.{0,240}\s-e\s+(?:(?:/usr)?/bin/)?(?:ba|da|z|k)?sh\b~is', '~\bsocat\b.{0,300}\bexec\s*:\s*(?:(?:/usr)?/bin/)?(?:ba|da|z|k)?sh\b~is', '~\bfsockopen\s*\(.{0,600}\b(?:exec|passthru|shell_exec|system)\s*\(~is', ], ], 'destructive_root_command' => [ 'label' => 'destructive root command', 'patterns' => [ '~(?:^|[;&|]\s*)rm\s+-[a-z]*r[a-z]*f[a-z]*(?:\s+--no-preserve-root)?\s+/+(?:\*?)(?=\s*(?:$|[;&|]))~is', ], ], ]; /** * Analyze command literals connected to a confirmed process invocation. * * @return array|null */ public static function analyze( array $tokens, $api, $method, $start, $methodIndex, $end, $scopeStart = 0 ) { $ranges = []; if (self::hasDirectCommandArgument($api, $method)) { $range = self::firstArgumentRange($tokens, $methodIndex + 1, $end); if ($range !== null) { $ranges[] = $range; } } $ranges = array_merge($ranges, self::carrierArgumentRanges($tokens, $start, $methodIndex)); if ($api === 'Symfony Messenger process message') { $messageRange = self::firstArgumentRange($tokens, $methodIndex + 1, $end); if ($messageRange !== null) { $ranges = array_merge($ranges, self::resolvedCarrierRanges($tokens, $messageRange, $scopeStart)); } } if (empty($ranges)) { $assignment = self::receiverAssignmentRange($tokens, $start, $scopeStart); if ($assignment !== null) { $ranges = array_merge( $ranges, self::carrierArgumentRanges($tokens, $assignment[0], $assignment[1]) ); } } foreach ($ranges as $range) { $command = self::renderRange($tokens, $range[0], $range[1], $scopeStart); $argumentVector = self::isArgumentVector($tokens, $range[0], $range[1], $scopeStart); $threat = self::matchThreat($command, $argumentVector); if ($threat !== null) { return $threat; } } return null; } private static function hasDirectCommandArgument($api, $method) { if ($api === 'Laravel Process facade' || $api === 'Laravel pending process') { return in_array(strtolower($method), ['run', 'start', 'concurrently'], true); } if ($api === 'WP_CLI') { return strtolower($method) === 'launch'; } return in_array($api, [ 'WordPress SSH filesystem', 'Magento shell', 'legacy Drush process helper', 'TYPO3 command utility', ], true); } private static function resolvedCarrierRanges(array $tokens, array $range, $scopeStart) { $ranges = self::carrierArgumentRanges($tokens, $range[0], $range[1] + 1); if (!empty($ranges)) { return $ranges; } $variable = self::singleVariable($tokens, $range[0], $range[1]); if ($variable === null) { return []; } $assignment = self::variableAssignmentRange($tokens, $variable, $range[0], $scopeStart); if ($assignment === null) { return []; } return self::carrierArgumentRanges($tokens, $assignment[0], $assignment[1]); } private static function carrierArgumentRanges(array $tokens, $start, $end) { $ranges = []; for ($index = $start; $index < $end && isset($tokens[$index]); $index++) { if ($tokens[$index]['id'] === T_NEW) { $open = self::nextOpeningParenthesis($tokens, $index + 1, $end); if ($open !== null && self::isCommandObject($tokens, $index + 1, $open - 1)) { $close = self::findMatching($tokens, $open, '(', ')'); $range = $close === null ? null : self::firstArgumentRange($tokens, $open, $close); if ($range !== null) { $ranges[] = $range; } } continue; } if ($tokens[$index]['id'] !== T_STRING || !in_array(strtolower($tokens[$index]['text']), self::COMMAND_CARRIERS, true) || !isset($tokens[$index + 1]) || $tokens[$index + 1]['text'] !== '(') { continue; } $close = self::findMatching($tokens, $index + 1, '(', ')'); $range = $close === null ? null : self::firstArgumentRange($tokens, $index + 1, $close); if ($range !== null) { $ranges[] = $range; } } return $ranges; } private static function isCommandObject(array $tokens, $start, $end) { $name = ''; for ($index = $start; $index <= $end && isset($tokens[$index]); $index++) { $name .= $tokens[$index]['text']; } $parts = explode('\\', strtolower(trim($name, '\\'))); $shortName = end($parts); return in_array($shortName, [ 'phpprocess', 'phpsubprocess', 'process', 'processbuilder', 'runprocessmessage', ], true); } private static function firstArgumentRange(array $tokens, $open, $close) { if (!isset($tokens[$open]) || $tokens[$open]['text'] !== '(' || $close <= $open + 1) { return null; } $depth = 0; for ($index = $open + 1; $index < $close; $index++) { if (in_array($tokens[$index]['text'], ['(', '[', '{'], true)) { $depth++; } elseif (in_array($tokens[$index]['text'], [')', ']', '}'], true)) { $depth--; } elseif ($tokens[$index]['text'] === ',' && $depth === 0) { return $index === $open + 1 ? null : [$open + 1, $index - 1]; } } return [$open + 1, $close - 1]; } private static function receiverAssignmentRange(array $tokens, $start, $scopeStart) { if (!isset($tokens[$start]) || $tokens[$start]['id'] !== T_VARIABLE) { return null; } if ($tokens[$start]['text'] !== '$this') { return self::variableAssignmentRange($tokens, $tokens[$start]['text'], $start, $scopeStart); } if (!isset($tokens[$start + 2]) || $tokens[$start + 1]['text'] !== '->') { return null; } $property = $tokens[$start + 2]['text']; for ($index = $start - 1; $index >= $scopeStart; $index--) { if ($tokens[$index]['text'] !== '$this' || !isset($tokens[$index + 4]) || $tokens[$index + 1]['text'] !== '->' || $tokens[$index + 2]['text'] !== $property || $tokens[$index + 3]['text'] !== '=') { continue; } return self::assignmentValueRange($tokens, $index + 4, $start); } return null; } private static function variableAssignmentRange(array $tokens, $variable, $before, $scopeStart) { for ($index = $before - 1; $index >= $scopeStart; $index--) { if ($tokens[$index]['id'] === T_VARIABLE && $tokens[$index]['text'] === $variable && isset($tokens[$index + 2]) && $tokens[$index + 1]['text'] === '=') { return self::assignmentValueRange($tokens, $index + 2, $before); } } return null; } private static function assignmentValueRange(array $tokens, $start, $limit) { $depth = 0; for ($index = $start; $index < $limit; $index++) { if (in_array($tokens[$index]['text'], ['(', '[', '{'], true)) { $depth++; } elseif (in_array($tokens[$index]['text'], [')', ']', '}'], true)) { if ($depth === 0) { break; } $depth--; } elseif ($depth === 0 && $tokens[$index]['text'] === ';') { break; } } return $index > $start ? [$start, $index - 1] : null; } private static function renderRange(array $tokens, $start, $end, $scopeStart, $depth = 0) { if ($depth >= self::MAX_ASSIGNMENT_DEPTH || $end < $start) { return ''; } $fragments = []; for ($index = $start; $index <= $end && isset($tokens[$index]); $index++) { if ($tokens[$index]['id'] === T_CONSTANT_ENCAPSED_STRING) { $fragments[] = self::decodeQuotedString($tokens[$index]['text']); continue; } if ($tokens[$index]['id'] !== null && token_name($tokens[$index]['id']) === 'T_ENCAPSED_AND_WHITESPACE') { $fragments[] = $tokens[$index]['text']; continue; } if ($tokens[$index]['id'] !== T_VARIABLE) { continue; } $assignment = self::variableAssignmentRange( $tokens, $tokens[$index]['text'], $index, $scopeStart ); if ($assignment !== null) { $fragments[] = self::renderRange( $tokens, $assignment[0], $assignment[1], $scopeStart, $depth + 1 ); } } return substr(implode(' ', $fragments), 0, self::MAX_COMMAND_LENGTH); } private static function decodeQuotedString($value) { if (strlen($value) < 2) { return $value; } $quote = $value[0]; $value = substr($value, 1, -1); if ($quote === "'") { return str_replace(['\\\\', "\\'"], ['\\', "'"], $value); } return stripcslashes($value); } private static function isArgumentVector(array $tokens, $start, $end, $scopeStart, $depth = 0) { if ($depth >= self::MAX_ASSIGNMENT_DEPTH || $end < $start) { return false; } while ($start < $end && $tokens[$start]['text'] === '(' && $tokens[$end]['text'] === ')') { $start++; $end--; } if ($tokens[$start]['text'] === '[' && $tokens[$end]['text'] === ']') { return true; } if ($tokens[$start]['id'] === T_ARRAY && isset($tokens[$start + 1]) && $tokens[$start + 1]['text'] === '(') { return true; } $variable = self::singleVariable($tokens, $start, $end); if ($variable === null) { return false; } $assignment = self::variableAssignmentRange($tokens, $variable, $start, $scopeStart); return $assignment !== null && self::isArgumentVector( $tokens, $assignment[0], $assignment[1], $scopeStart, $depth + 1 ); } private static function argumentVectorRunsShellCode($command) { return preg_match( '~^(?:(?:(?:/usr)?/bin/)?env\s+)?(?:(?:/usr)?/bin/)?(?:ba|da|z|k)?sh\s+-[a-z]*c\b~i', $command ) === 1 || preg_match( '~^(?:[a-z]:[\\\\/][^\s]+[\\\\/])?(?:powershell|pwsh)(?:\.exe)?\s+-(?:c|command)\b~i', $command ) === 1; } private static function matchThreat($command, $argumentVector) { if ($command === '') { return null; } foreach (self::THREATS as $key => $details) { if ($key === 'download_execution' && $argumentVector && !self::argumentVectorRunsShellCode($command)) { continue; } foreach ($details['patterns'] as $pattern) { if (preg_match($pattern, $command) === 1) { return [ 'key' => $key, 'label' => $details['label'], ]; } } } return null; } private static function singleVariable(array $tokens, $start, $end) { while ($start <= $end && $tokens[$start]['text'] === '(') { $start++; } while ($end >= $start && $tokens[$end]['text'] === ')') { $end--; } return $start === $end && $tokens[$start]['id'] === T_VARIABLE ? $tokens[$start]['text'] : null; } private static function nextOpeningParenthesis(array $tokens, $start, $end) { for ($index = $start; $index < $end && isset($tokens[$index]); $index++) { if ($tokens[$index]['text'] === '(') { return $index; } if (in_array($tokens[$index]['text'], [';', '{', '}'], true)) { break; } } return null; } private static function findMatching(array $tokens, $open, $opening, $closing) { $depth = 0; $count = count($tokens); for ($index = $open; $index < $count; $index++) { if ($tokens[$index]['text'] === $opening) { $depth++; } elseif ($tokens[$index]['text'] === $closing && --$depth === 0) { return $index; } } return null; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform; abstract class ProcessApiProviderAbstract implements ProcessApiProviderInterface { public function getClassTypes() { return []; } public function getTypeDetails() { return []; } public function getStaticReturnTypes() { return []; } public function getInstanceReturnTypes() { return []; } public function getFunctions() { return []; } public function allowsStaticTerminalCall($type, $method, array $arguments) { return true; } public function allowsInstanceTerminalCall($type, $method, array $arguments, array $argumentTypes) { return true; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\Yii; use AMWScan\Platform\ProcessApiProviderAbstract; class ProcessApiProvider extends ProcessApiProviderAbstract { private const SERVE_TYPE = 'yii-serve-command'; public function getClassTypes() { return [ 'yii\console\controllers\servecontroller' => self::SERVE_TYPE, 'yiisoft\yii\console\command\serve' => self::SERVE_TYPE, ]; } public function getTypeDetails() { return [ self::SERVE_TYPE => [ 'platform' => 'Yii', 'api' => 'Yii development server', 'instanceTerminals' => ['actionindex', 'execute'], 'staticTerminals' => [], ], ]; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\Yii; use AMWScan\Platform\ComposerPackageVerifierAbstract; class Verifier extends ComposerPackageVerifierAbstract { protected static function getPackageNames() { return [ 'yiisoft/yii', 'yiisoft/yii2', ]; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\PrestaShop; use AMWScan\Platform\ProcessApiProviderAbstract; class ProcessApiProvider extends ProcessApiProviderAbstract { private const CACHE_CLEARER_TYPE = 'prestashop-exec-cache-clearer'; public function getClassTypes() { return [ 'prestashop\prestashop\adapter\cache\clearer\symfony\execkernelcacheclearer' => self::CACHE_CLEARER_TYPE, ]; } public function getTypeDetails() { return [ self::CACHE_CLEARER_TYPE => [ 'platform' => 'PrestaShop', 'api' => 'PrestaShop executable kernel cache clearer', 'instanceTerminals' => ['clearkernelcache'], 'staticTerminals' => [], ], ]; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\PrestaShop; use AMWScan\Platform\RepositoryVerifier; class Verifier extends RepositoryVerifier { protected static $roots = []; public static function isRoot($path) { return is_dir($path) && is_file(static::getVersionFile($path)) && is_file($path . DIRECTORY_SEPARATOR . 'config' . DIRECTORY_SEPARATOR . 'defines.inc.php') && is_file($path . DIRECTORY_SEPARATOR . 'app' . DIRECTORY_SEPARATOR . 'AppKernel.php'); } public static function getVersion($root) { $content = @file_get_contents(static::getVersionFile($root)); if ($content !== false && preg_match('/\b(?:public\s+)?const\s+VERSION\s*=\s*[\'\"]([0-9][0-9A-Za-z.\-]*)[\'\"]\s*;/', $content, $match)) { return $match[1]; } return null; } protected static function getPlatformName() { return 'PrestaShop'; } protected static function getRepository() { return 'PrestaShop/PrestaShop'; } private static function getVersionFile($root) { $files = [ $root . DIRECTORY_SEPARATOR . 'src' . DIRECTORY_SEPARATOR . 'Core' . DIRECTORY_SEPARATOR . 'Version.php', $root . DIRECTORY_SEPARATOR . 'app' . DIRECTORY_SEPARATOR . 'AppKernel.php', ]; foreach ($files as $file) { if (is_file($file)) { return $file; } } return $files[0]; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\Laravel; use AMWScan\Platform\ProcessApiProviderAbstract; class ProcessApiProvider extends ProcessApiProviderAbstract { private const FACADE_TYPE = 'laravel-facade'; private const PENDING_TYPE = 'laravel-pending'; private const PIPE_TYPE = 'laravel-pipe'; private const POOL_TYPE = 'laravel-pool'; public function getClassTypes() { return [ 'illuminate\\support\\facades\\process' => self::FACADE_TYPE, 'illuminate\\process\\pendingprocess' => self::PENDING_TYPE, 'illuminate\\process\\pipe' => self::PIPE_TYPE, 'illuminate\\process\\pool' => self::POOL_TYPE, ]; } public function getTypeDetails() { return [ self::FACADE_TYPE => [ 'platform' => 'Laravel', 'api' => 'Laravel Process facade', 'instanceTerminals' => [], 'staticTerminals' => ['run', 'start', 'pipe', 'concurrently'], ], self::PENDING_TYPE => [ 'platform' => 'Laravel', 'api' => 'Laravel pending process', 'instanceTerminals' => ['run', 'start'], 'staticTerminals' => [], ], self::PIPE_TYPE => [ 'platform' => 'Laravel', 'api' => 'Laravel process pipe', 'instanceTerminals' => ['run'], 'staticTerminals' => [], ], self::POOL_TYPE => [ 'platform' => 'Laravel', 'api' => 'Laravel process pool', 'instanceTerminals' => ['start', 'run', 'wait'], 'staticTerminals' => [], ], ]; } public function getStaticReturnTypes() { $pendingMethods = array_fill_keys($this->pendingMethods(), self::PENDING_TYPE); $pendingMethods['newpendingprocess'] = self::PENDING_TYPE; return [ self::FACADE_TYPE => $pendingMethods + ['pool' => self::POOL_TYPE], ]; } public function getInstanceReturnTypes() { $pendingMethods = array_fill_keys($this->pendingMethods(), self::PENDING_TYPE); return [ self::PENDING_TYPE => $pendingMethods, self::PIPE_TYPE => $pendingMethods + ['as' => self::PENDING_TYPE], self::POOL_TYPE => $pendingMethods + ['as' => self::PENDING_TYPE], ]; } private function pendingMethods() { return [ 'command', 'path', 'timeout', 'idletimeout', 'forever', 'env', 'input', 'quietly', 'tty', 'options', ]; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\Laravel; use AMWScan\Platform\ComposerPackageVerifierAbstract; class Verifier extends ComposerPackageVerifierAbstract { protected static function getPackageNames() { return ['laravel/framework']; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\Joomla; use AMWScan\Platform\ProcessApiProviderAbstract; class ProcessApiProvider extends ProcessApiProviderAbstract { private const DAEMON_TYPE = 'joomla-daemon'; public function getClassTypes() { return [ 'joomla\cms\application\daemonapplication' => self::DAEMON_TYPE, ]; } public function getTypeDetails() { return [ self::DAEMON_TYPE => [ 'platform' => 'Joomla', 'api' => 'Joomla daemon lifecycle', 'instanceTerminals' => ['restart', 'stop'], 'staticTerminals' => [], ], ]; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\Joomla; use AMWScan\Platform\RepositoryVerifier; class Verifier extends RepositoryVerifier { protected static $roots = []; public static function isRoot($path) { return is_dir($path) && is_dir($path . DIRECTORY_SEPARATOR . 'administrator') && is_dir($path . DIRECTORY_SEPARATOR . 'components') && is_dir($path . DIRECTORY_SEPARATOR . 'includes') && static::getVersionFile($path) !== null; } public static function getVersion($root) { $versionFile = static::getVersionFile($root); if ($versionFile === null) { return null; } $content = @file_get_contents($versionFile); if ($content === false) { return null; } $parts = []; foreach (['MAJOR_VERSION', 'MINOR_VERSION', 'PATCH_VERSION'] as $constant) { if (!preg_match('/\bconst\s+' . $constant . '\s*=\s*[\'"]?([0-9]+)[\'"]?\s*;/', $content, $match)) { $parts = []; break; } $parts[] = $match[1]; } if (!empty($parts)) { $version = implode('.', $parts); if (preg_match('/\bconst\s+EXTRA_VERSION\s*=\s*[\'"]([^\'"]*)[\'"]\s*;/', $content, $match) && $match[1] !== '') { $version .= '-' . $match[1]; } return $version; } if (preg_match('/\bconst\s+RELEASE\s*=\s*[\'"]([0-9.]+)[\'"]\s*;/', $content, $release) && preg_match('/\bconst\s+DEV_LEVEL\s*=\s*[\'"]([0-9]+)[\'"]\s*;/', $content, $level)) { return $release[1] . '.' . $level[1]; } return null; } protected static function getPlatformName() { return 'Joomla'; } protected static function getRepository() { return 'joomla/joomla-cms'; } private static function getVersionFile($root) { $files = [ $root . DIRECTORY_SEPARATOR . 'libraries' . DIRECTORY_SEPARATOR . 'src' . DIRECTORY_SEPARATOR . 'Version.php', $root . DIRECTORY_SEPARATOR . 'libraries' . DIRECTORY_SEPARATOR . 'cms' . DIRECTORY_SEPARATOR . 'version' . DIRECTORY_SEPARATOR . 'version.php', ]; foreach ($files as $file) { if (is_file($file)) { return $file; } } return null; } } wordpressDatabaseFactory = $wordpressDatabaseFactory ?: static function ($administratorThreshold, array $adminWhitelist = [], $adminWhitelistPath = '') { return new Database(null, $administratorThreshold, $adminWhitelist, $adminWhitelistPath); }; $this->phaseFactories = [ 'scan-wordpress-db' => function (array $settings) { return new DatabaseScanPhase( WordPress::getRoots(), $this->wordpressDatabaseFactory, $settings['wordpress-admin-threshold'] ?? Database::MAX_NORMAL_ADMINISTRATOR_THRESHOLD, $settings['wordpress-admin-whitelist'] ?? [], $settings['wordpress-admin-whitelist-path'] ?? '' ); }, ]; } public function prepare($path, $verifierEnabled, $discoverWordpress) { if ($verifierEnabled) { PlatformRegistry::reset(); PlatformRegistry::init($path); } if (!$verifierEnabled) { WordPress::reset(); } WordPress::discoverFromPath($path); } public function discoverDirectory($path, $verifierEnabled, $discoverWordpress) { if ($verifierEnabled) { PlatformRegistry::init($path); } else { WordPress::discover($path); } } public function isVerified($path) { return PlatformRegistry::isVerified($path); } public function binarySignatureFindings($path) { return PlatformRegistry::binarySignatureFindings($path); } public function sourceSizeFinding($path, $size) { return SourceSizeAnalyzer::finding($path, $size); } public function processFindings($content) { return ProcessDetector::scan($content); } public function runEnabledPhases(array $report, array $selections, array $settings, $fileScanComplete, ?callable $heartbeat = null) { foreach ($this->phaseFactories as $setting => $factory) { if (empty($settings[$setting])) { continue; } if ($heartbeat !== null) { call_user_func($heartbeat); } $phase = call_user_func($factory, $settings); if (!$phase instanceof ScanPhaseInterface) { throw new \LogicException('Platform scan phase must implement ScanPhaseInterface.'); } $report = $fileScanComplete ? $phase->run($report, $selections) : $phase->skipped($report, $selections); if ($heartbeat !== null) { call_user_func($heartbeat); } } return $report; } public function integrityFindings($path) { return PlatformRegistry::integrityFindings($path); } public function inventory($path) { return PlatformRegistry::inventory($path); } public function enrichInventory(array $components, $checkUpdates = false) { return PlatformRegistry::enrichInventory($components, $checkUpdates); } public function reportSection($section, array $data, $format) { return PlatformRegistry::reportSection($section, $data, $format); } public function reportHTML(array $data) { return (new ComponentReport())->html($data['inventory'] ?? []); } public function reportText(array $data) { return (new ComponentReport())->text($data['inventory'] ?? []); } public function contentInventoryResult($path) { return PlatformRegistry::contentInventoryResult($path); } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\TYPO3; use AMWScan\Platform\ProcessApiProviderAbstract; class ProcessApiProvider extends ProcessApiProviderAbstract { private const COMMAND_UTILITY_TYPE = 'typo3-command-utility'; public function getClassTypes() { return [ 'typo3\cms\core\utility\commandutility' => self::COMMAND_UTILITY_TYPE, ]; } public function getTypeDetails() { return [ self::COMMAND_UTILITY_TYPE => [ 'platform' => 'TYPO3', 'api' => 'TYPO3 command utility', 'instanceTerminals' => [], 'staticTerminals' => ['exec'], ], ]; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Platform\TYPO3; use AMWScan\Platform\RepositoryVerifier; class Verifier extends RepositoryVerifier { protected static $roots = []; public static function isRoot($path) { return is_dir($path) && is_file($path . DIRECTORY_SEPARATOR . 'composer.json') && is_file(static::getVersionFile($path)) && is_file( $path . DIRECTORY_SEPARATOR . 'typo3' . DIRECTORY_SEPARATOR . 'sysext' . DIRECTORY_SEPARATOR . 'core' . DIRECTORY_SEPARATOR . 'composer.json' ); } public static function getVersion($root) { $content = @file_get_contents(static::getVersionFile($root)); if ($content === false) { return null; } if (preg_match('/\b(?:protected\s+)?const\s+VERSION\s*=\s*[\'\"]([0-9][0-9A-Za-z.\-]*)[\'\"]\s*;/', $content, $match) || preg_match('/\bdefine\s*\(\s*[\'\"]TYPO3_version[\'\"]\s*,\s*[\'\"]([0-9][0-9A-Za-z.\-]*)[\'\"]\s*\)/', $content, $match)) { return $match[1]; } return null; } protected static function getPlatformName() { return 'TYPO3'; } protected static function getRepository() { return 'TYPO3/typo3'; } protected static function getReleaseReference($version) { $major = (int)strtok($version, '.'); return $major >= 9 ? 'v' . $version : 'TYPO3_' . str_replace('.', '-', $version); } private static function getVersionFile($root) { $base = $root . DIRECTORY_SEPARATOR . 'typo3' . DIRECTORY_SEPARATOR . 'sysext' . DIRECTORY_SEPARATOR . 'core' . DIRECTORY_SEPARATOR . 'Classes' . DIRECTORY_SEPARATOR; $files = [ $base . 'Information' . DIRECTORY_SEPARATOR . 'Typo3Version.php', $base . 'Core' . DIRECTORY_SEPARATOR . 'SystemEnvironmentBuilder.php', ]; foreach ($files as $file) { if (is_file($file)) { return $file; } } return $files[0]; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Reputation; class DomainExtractor { private const MAX_DOMAINS = 10000; public function extract($content) { if (!is_string($content)) { throw new \InvalidArgumentException('Observable content must be a string.'); } $domains = []; $offset = 0; while (count($domains) < self::MAX_DOMAINS && preg_match('~https?://[^\s<>"\'\[\]()]+~i', $content, $match, PREG_OFFSET_CAPTURE, $offset) === 1) { $url = $match[0][0]; $offset = $match[0][1] + max(1, strlen($url)); $url = rtrim($url, '.,;:!?'); $parts = parse_url($url); if (!is_array($parts) || empty($parts['host']) || isset($parts['user']) || isset($parts['pass'])) { continue; } $host = strtolower(rtrim($parts['host'], '.')); if (!$this->isPublicDomain($host)) { continue; } $domains[$host] = true; } $domains = array_keys($domains); sort($domains); return $domains; } private function isPublicDomain($host) { if (filter_var($host, FILTER_VALIDATE_IP)) { return false; } return strpos($host, '.') !== false && filter_var($host, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME) !== false; } } path = rtrim($path, DIRECTORY_SEPARATOR); $this->metadata = null; $this->index = null; } public static function getDefaultPath() { $userIdentifier = function_exists('posix_getuid') ? (string)posix_getuid() : md5(get_current_user()); return sys_get_temp_dir() . DIRECTORY_SEPARATOR . 'amwscan' . DIRECTORY_SEPARATOR . $userIdentifier . DIRECTORY_SEPARATOR . 'definitions'; } public function load() { $manifestPath = $this->path . DIRECTORY_SEPARATOR . 'active.json'; if (!is_file($manifestPath)) { throw new \RuntimeException('Maltrail definition manifest is unavailable.'); } $contents = file_get_contents($manifestPath); $metadata = is_string($contents) ? json_decode($contents, true) : null; if (!is_array($metadata) || !$this->isValidMetadata($metadata)) { throw new \RuntimeException('Maltrail definition manifest is invalid.'); } $indexPath = $this->path . DIRECTORY_SEPARATOR . $metadata['base']; if (!is_file($indexPath) || filesize($indexPath) !== $metadata['records'] * $metadata['hash_bytes']) { throw new \RuntimeException('Maltrail definition index is invalid.'); } if (!hash_equals(strtolower($metadata['index_sha256']), hash_file('sha256', $indexPath))) { throw new \RuntimeException('Maltrail definition index checksum does not match.'); } $index = file_get_contents($indexPath); if (!is_string($index)) { throw new \RuntimeException('Maltrail definition index cannot be read.'); } $this->metadata = $metadata; $this->index = $index; } public function refresh() { $this->ensureDirectory(); $lock = fopen($this->path . DIRECTORY_SEPARATOR . 'update.lock', 'c+'); if ($lock === false || !flock($lock, LOCK_EX)) { if (is_resource($lock)) { fclose($lock); } throw new \RuntimeException('Unable to lock the Maltrail definition cache.'); } try { try { $this->load(); } catch (\RuntimeException $exception) { } $archive = $this->downloadArchive(); try { $this->activateArchive($archive); } finally { @unlink($archive); } $this->load(); } finally { flock($lock, LOCK_UN); fclose($lock); } } public function isActive() { return $this->metadata !== null && $this->index !== null; } public function getMetadata() { return $this->metadata; } public function matches($domain) { if (!$this->isActive()) { return false; } $hash = substr(hash('sha256', strtolower(rtrim($domain, '.')), true), 0, $this->metadata['hash_bytes']); $low = 0; $high = $this->metadata['records'] - 1; while ($low <= $high) { $middle = intdiv($low + $high, 2); $candidate = substr($this->index, $middle * $this->metadata['hash_bytes'], $this->metadata['hash_bytes']); $comparison = strcmp($hash, $candidate); if ($comparison === 0) { return true; } if ($comparison < 0) { $high = $middle - 1; } else { $low = $middle + 1; } } return false; } private function isValidMetadata(array $metadata) { return isset($metadata['schema'], $metadata['provider'], $metadata['records'], $metadata['hash_bytes'], $metadata['index_sha256'], $metadata['base']) && $metadata['schema'] === 1 && $metadata['provider'] === 'maltrail' && is_int($metadata['records']) && $metadata['records'] > 0 && is_int($metadata['hash_bytes']) && $metadata['hash_bytes'] > 0 && $metadata['hash_bytes'] <= 32 && is_string($metadata['index_sha256']) && preg_match('/^[a-f0-9]{64}$/i', $metadata['index_sha256']) === 1 && is_string($metadata['base']) && basename($metadata['base']) === $metadata['base']; } private function ensureDirectory() { if (!is_dir($this->path) && !mkdir($this->path, 0700, true) && !is_dir($this->path)) { throw new \RuntimeException('Unable to create the Maltrail definition cache directory.'); } if (is_link($this->path)) { throw new \RuntimeException('Maltrail definition cache directory must not be a symbolic link.'); } if (DIRECTORY_SEPARATOR !== '\\') { @chmod($this->path, 0700); } } private function downloadArchive() { $context = stream_context_create(['http' => [ 'timeout' => 30, 'follow_location' => 1, 'max_redirects' => 3, 'header' => "User-Agent: AMWScan\r\nAccept: application/gzip\r\n", ]]); $source = fopen(self::SOURCE_URL, 'rb', false, $context); if ($source === false) { throw new \RuntimeException('Unable to download Maltrail definitions.'); } try { $archive = $this->createTemporaryArchive(); } catch (\RuntimeException $exception) { fclose($source); throw $exception; } $target = fopen($archive, 'wb'); if ($target === false || stream_copy_to_stream($source, $target) === false) { fclose($source); if (is_resource($target)) { fclose($target); } @unlink($archive); throw new \RuntimeException('Unable to cache downloaded Maltrail definitions.'); } fclose($source); fclose($target); if (filesize($archive) === 0) { if (is_string($archive)) { @unlink($archive); } throw new \RuntimeException('Unable to cache downloaded Maltrail definitions.'); } return $archive; } private function createTemporaryArchive() { $temporary = tempnam($this->path, 'maltrail-'); if ($temporary === false) { throw new \RuntimeException('Unable to cache downloaded Maltrail definitions.'); } $archive = $temporary . '.tar.gz'; if (!rename($temporary, $archive)) { @unlink($temporary); throw new \RuntimeException('Unable to cache downloaded Maltrail definitions.'); } return $archive; } private function activateArchive($archive) { try { $phar = new \PharData($archive); } catch (\UnexpectedValueException $exception) { throw new \RuntimeException('Downloaded Maltrail definitions are not a valid archive: ' . $exception->getMessage(), 0, $exception); } $buckets = $this->openBuckets(); try { $iterator = new \RecursiveIteratorIterator($phar, \RecursiveIteratorIterator::LEAVES_ONLY); foreach ($iterator as $file) { $path = str_replace('\\', '/', $file->getPathname()); if (strpos($path, '/malware/') === false || substr($path, -4) !== '.txt') { continue; } $contents = file_get_contents($file->getPathname()); if (!is_string($contents)) { throw new \RuntimeException('Unable to read a Maltrail definition file.'); } foreach (preg_split('/\R/', $contents) as $line) { $domain = $this->extractDomain($line); if ($domain !== null) { $hash = substr(hash('sha256', $domain, true), 0, 8); fwrite($buckets[ord($hash[0])]['handle'], $hash); } } } $indexTemporary = tempnam($this->path, 'maltrail-index-'); $indexHandle = $indexTemporary === false ? false : fopen($indexTemporary, 'wb'); if ($indexHandle === false) { throw new \RuntimeException('Unable to build the Maltrail definition index.'); } $records = 0; foreach ($buckets as $bucket) { fclose($bucket['handle']); $data = file_get_contents($bucket['path']); if (!is_string($data) || strlen($data) % 8 !== 0) { fclose($indexHandle); throw new \RuntimeException('Unable to read the Maltrail definition index bucket.'); } $hashes = array_unique(str_split($data, 8)); sort($hashes, SORT_STRING); $records += count($hashes); fwrite($indexHandle, implode('', $hashes)); } fclose($indexHandle); } finally { foreach ($buckets as $bucket) { if (is_resource($bucket['handle'])) { fclose($bucket['handle']); } @unlink($bucket['path']); } } if ($records === 0) { @unlink($indexTemporary); throw new \RuntimeException('Downloaded Maltrail definitions contain no domain indicators.'); } $indexHash = hash_file('sha256', $indexTemporary); $base = 'domains-' . $indexHash . '.bin'; $indexPath = $this->path . DIRECTORY_SEPARATOR . $base; if (!rename($indexTemporary, $indexPath)) { @unlink($indexTemporary); throw new \RuntimeException('Unable to activate the Maltrail definition index.'); } $metadata = [ 'schema' => 1, 'provider' => 'maltrail', 'records' => $records, 'hash_bytes' => 8, 'source_sha256' => hash_file('sha256', $archive), 'index_sha256' => $indexHash, 'base' => $base, 'updated_at' => gmdate('c'), ]; $encoded = json_encode($metadata, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES); if (!is_string($encoded) || file_put_contents($this->path . DIRECTORY_SEPARATOR . 'active.json.tmp', $encoded, LOCK_EX) === false || !rename($this->path . DIRECTORY_SEPARATOR . 'active.json.tmp', $this->path . DIRECTORY_SEPARATOR . 'active.json')) { @unlink($this->path . DIRECTORY_SEPARATOR . 'active.json.tmp'); throw new \RuntimeException('Unable to activate Maltrail definition metadata.'); } } private function extractDomain($line) { $line = trim($line); if ($line === '' || strpos($line, '#') === 0) { return null; } $host = parse_url(strpos($line, '://') === false ? '//' . $line : $line, PHP_URL_HOST); $domain = strtolower(rtrim(is_string($host) ? $host : '', '.')); return strpos($domain, '.') !== false && filter_var($domain, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME) !== false ? $domain : null; } private function openBuckets() { $buckets = []; for ($index = 0; $index < 256; $index++) { $path = tempnam($this->path, 'maltrail-bucket-'); $handle = $path === false ? false : fopen($path, 'wb'); if ($handle === false) { foreach ($buckets as $bucket) { fclose($bucket['handle']); @unlink($bucket['path']); } throw new \RuntimeException('Unable to prepare the Maltrail definition index buckets.'); } $buckets[$index] = ['path' => $path, 'handle' => $handle]; } return $buckets; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Reputation; use AMWScan\Detection\Signatures; use AMWScan\Findings\Finding; class DomainScanner { private $maltrail; public function __construct(?MaltrailDefinitionStore $maltrail = null) { $this->maltrail = $maltrail; } public function scan(array $domains, $subject, ?array $definitions = null, $provider = 'builtin-signatures') { $useMaltrail = $definitions === null && $this->maltrail !== null; $definitions = $definitions === null ? Signatures::getDomainIndicators() : $definitions; $index = []; foreach ($definitions as $definition) { if (is_array($definition) && isset($definition['domain'])) { $index[strtolower($definition['domain'])] = $definition; } } $findings = []; foreach (array_values(array_unique($domains)) as $domain) { $entry = $this->lookup($index, $domain); if ($entry === null && $useMaltrail) { $entry = $this->lookupMaltrail($domain); } if ($entry === null || $entry['classification'] === 'allow') { continue; } $findings[] = Finding::create( 'reputation', $subject . '#' . strtolower($domain), $entry['id'], $entry['severity'], sprintf('Content references a %s domain.', $entry['classification']), [ 'domain' => strtolower($domain), 'listed_domain' => $entry['domain'], 'classification' => $entry['classification'], ], isset($entry['provider']) ? $entry['provider'] : $provider ); } return $findings; } private function lookup(array $index, $domain) { $labels = explode('.', strtolower($domain)); while (count($labels) >= 2) { $candidate = implode('.', $labels); if (isset($index[$candidate])) { return $index[$candidate]; } array_shift($labels); } return null; } private function lookupMaltrail($domain) { $labels = explode('.', strtolower($domain)); while (count($labels) >= 2) { $candidate = implode('.', $labels); if ($this->maltrail->matches($candidate)) { return [ 'id' => 'maltrail-domain:' . $candidate, 'domain' => $candidate, 'classification' => 'malicious', 'severity' => 'warn', 'provider' => 'maltrail', ]; } array_shift($labels); } return null; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Remote; interface FtpClientInterface { public function login($username, $password); public function setPassive($passive); public function listDirectory($path); public function download($remotePath, $localPath, $maxBytes); public function close(); } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Remote; class NativeFtpClient implements FtpClientInterface { protected $connection; public function __construct($host, $port, $secure = false, $timeout = 15) { if (!function_exists('ftp_connect')) { throw new \RuntimeException('FTP scanning requires the PHP FTP extension'); } if ($secure && !function_exists('ftp_ssl_connect')) { throw new \RuntimeException('FTPS is not supported by this PHP FTP extension'); } if ($port < 1 || $port > 65535) { throw new \RuntimeException('Invalid FTP port'); } $address = $this->resolvePublicAddress($host); $this->connection = $secure ? @ftp_ssl_connect($address, $port, $timeout) : @ftp_connect($address, $port, $timeout); if ($this->connection === false) { throw new \RuntimeException('Unable to connect to the FTP server'); } if (defined('FTP_USEPASVADDRESS') && function_exists('ftp_set_option')) { @ftp_set_option($this->connection, FTP_USEPASVADDRESS, false); } } public function login($username, $password) { if (!@ftp_login($this->connection, $username, $password)) { throw new \RuntimeException('FTP authentication failed'); } } public function setPassive($passive) { if (!@ftp_pasv($this->connection, (bool)$passive)) { throw new \RuntimeException('Unable to configure FTP passive mode'); } } public function listDirectory($path) { $entries = @ftp_mlsd($this->connection, $path); if (!is_array($entries)) { throw new \RuntimeException('The FTP server does not provide an MLSD directory listing for: ' . $path); } return array_map(function ($entry) { return [ 'name' => isset($entry['name']) ? $entry['name'] : '', 'type' => isset($entry['type']) ? strtolower($entry['type']) : '', 'size' => isset($entry['size']) ? (int)$entry['size'] : -1, ]; }, $entries); } public function download($remotePath, $localPath, $maxBytes) { $handle = fopen($localPath, 'wb'); if ($handle === false) { return false; } $status = @ftp_nb_fget($this->connection, $handle, $remotePath, FTP_BINARY); while ($status === FTP_MOREDATA) { if (ftell($handle) > $maxBytes) { @ftp_close($this->connection); $this->connection = null; fclose($handle); @unlink($localPath); return false; } $status = @ftp_nb_continue($this->connection); } $downloaded = $status === FTP_FINISHED && ftell($handle) <= $maxBytes; fclose($handle); if (!$downloaded) { @unlink($localPath); } return $downloaded; } public function close() { if ($this->connection !== null) { @ftp_close($this->connection); $this->connection = null; } } protected function resolvePublicAddress($host) { $host = trim($host, '[]'); if (filter_var($host, FILTER_VALIDATE_IP)) { if (!filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) { throw new \RuntimeException('Private and reserved FTP addresses are not allowed'); } return $host; } $addresses = @gethostbynamel($host); if (!is_array($addresses) || empty($addresses)) { throw new \RuntimeException('Unable to resolve the FTP host'); } foreach ($addresses as $address) { if (!filter_var($address, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) { throw new \RuntimeException('Private and reserved FTP addresses are not allowed'); } } return $addresses[0]; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Remote; class FtpMirror { protected const MAX_DEPTH = 64; protected const MAX_FILES = 10000; protected const MAX_FILE_BYTES = 67108864; protected const MAX_TOTAL_BYTES = 536870912; protected $clientFactory; protected $mirrors = []; protected $files = 0; protected $bytes = 0; protected $entries = 0; public function __construct($clientFactory = null) { if ($clientFactory !== null && !is_callable($clientFactory)) { throw new \InvalidArgumentException('FTP client factory must be callable or null'); } $this->clientFactory = $clientFactory; } public function __destruct() { $this->cleanup(); } public function mirror($uri, $username = null, $password = null) { $source = $this->parseSource($uri, $username, $password); $localPath = sys_get_temp_dir() . DIRECTORY_SEPARATOR . 'amwscan-ftp-' . bin2hex(random_bytes(8)); if (!mkdir($localPath, 0700, true) && !is_dir($localPath)) { throw new \RuntimeException('Unable to create the FTP mirror directory'); } $this->mirrors[] = $localPath; $client = null; try { $client = $this->createClient($source); $client->login($source['username'], $source['password']); $client->setPassive(true); $this->mirrorDirectory($client, $source['path'], $localPath, 0); } catch (\Throwable $exception) { $this->removeDirectory($localPath); throw new \RuntimeException('FTP mirror failed: ' . $exception->getMessage(), 0, $exception); } finally { if ($client instanceof FtpClientInterface) { try { $client->close(); } catch (\Throwable $closeException) { } } } return $localPath; } public function cleanup() { foreach ($this->mirrors as $mirror) { $this->removeDirectory($mirror); } $this->mirrors = []; $this->files = 0; $this->bytes = 0; $this->entries = 0; } protected function parseSource($uri, $username, $password) { $parts = parse_url($uri); if (!is_array($parts) || empty($parts['scheme']) || empty($parts['host'])) { throw new \InvalidArgumentException('Invalid FTP source URI'); } $scheme = strtolower($parts['scheme']); if (!in_array($scheme, ['ftp', 'ftps'], true)) { throw new \InvalidArgumentException('FTP source must use ftp:// or ftps://'); } if (isset($parts['query']) || isset($parts['fragment'])) { throw new \InvalidArgumentException('FTP source URI must not contain a query or fragment'); } if (isset($parts['user']) || isset($parts['pass'])) { throw new \InvalidArgumentException('FTP credentials must be provided through options or environment variables, not the URI'); } $username = $username !== null ? $username : getenv('AMWSCAN_FTP_USER'); $password = $password !== null ? $password : getenv('AMWSCAN_FTP_PASSWORD'); return [ 'scheme' => $scheme, 'host' => $parts['host'], 'port' => isset($parts['port']) ? (int)$parts['port'] : 21, 'path' => isset($parts['path']) && $parts['path'] !== '' ? '/' . ltrim(rawurldecode($parts['path']), '/') : '/', 'username' => is_string($username) && $username !== '' ? $username : 'anonymous', 'password' => is_string($password) ? $password : '', ]; } protected function createClient($source) { $connection = [ 'scheme' => $source['scheme'], 'host' => $source['host'], 'port' => $source['port'], 'path' => $source['path'], ]; $client = $this->clientFactory === null ? new NativeFtpClient($source['host'], $source['port'], $source['scheme'] === 'ftps') : call_user_func($this->clientFactory, $connection); if (!$client instanceof FtpClientInterface) { throw new \RuntimeException('FTP client factory returned an invalid client'); } return $client; } protected function mirrorDirectory($client, $remotePath, $localPath, $depth) { if ($depth > self::MAX_DEPTH) { throw new \RuntimeException('FTP directory depth limit exceeded'); } $names = []; foreach ($client->listDirectory($remotePath) as $entry) { if (++$this->entries > self::MAX_FILES * 2) { throw new \RuntimeException('FTP directory entry limit exceeded'); } if (!is_array($entry)) { throw new \RuntimeException('FTP directory contains an unsafe entry name'); } $type = isset($entry['type']) ? strtolower($entry['type']) : ''; if (in_array($type, ['cdir', 'pdir'], true)) { continue; } if (!$this->isSafeName(isset($entry['name']) ? $entry['name'] : '')) { throw new \RuntimeException('FTP directory contains an unsafe entry name'); } $name = $entry['name']; $nameKey = strtolower(rtrim($name, '. ')); if (isset($names[$nameKey])) { throw new \RuntimeException('FTP directory contains duplicate entry names'); } $names[$nameKey] = true; $remoteEntry = rtrim($remotePath, '/') . '/' . $name; $localEntry = $localPath . DIRECTORY_SEPARATOR . $name; if ($type === 'dir') { if (!mkdir($localEntry, 0700, true) && !is_dir($localEntry)) { throw new \RuntimeException('Unable to create a local FTP directory'); } $this->mirrorDirectory($client, $remoteEntry, $localEntry, $depth + 1); continue; } if ($type !== 'file') { continue; } $declaredSize = isset($entry['size']) ? (int)$entry['size'] : -1; if ($declaredSize > self::MAX_FILE_BYTES || ($declaredSize >= 0 && $this->bytes + $declaredSize > self::MAX_TOTAL_BYTES)) { throw new \RuntimeException('FTP download size limit exceeded'); } if (++$this->files > self::MAX_FILES) { throw new \RuntimeException('FTP file count limit exceeded'); } $partialPath = $localEntry . '.part'; $remainingBytes = min(self::MAX_FILE_BYTES, self::MAX_TOTAL_BYTES - $this->bytes); if (!$client->download($remoteEntry, $partialPath, $remainingBytes)) { throw new \RuntimeException('Unable to download FTP file: ' . $remoteEntry); } $actualSize = filesize($partialPath); if ($actualSize === false || $actualSize > self::MAX_FILE_BYTES || $this->bytes + $actualSize > self::MAX_TOTAL_BYTES) { @unlink($partialPath); throw new \RuntimeException('FTP download size limit exceeded'); } $this->bytes += $actualSize; if (!rename($partialPath, $localEntry)) { @unlink($partialPath); throw new \RuntimeException('Unable to finalize a mirrored FTP file'); } } } protected function isSafeName($name) { if (!is_string($name) || $name === '' || $name === '.' || $name === '..' || rtrim($name, '. ') !== $name || strpbrk($name, '<>:"/\\|?*') !== false || preg_match('/[\x00-\x1F\x7F]/', $name)) { return false; } $baseName = strtoupper(explode('.', $name, 2)[0]); $reserved = ['CON', 'PRN', 'AUX', 'NUL']; for ($index = 1; $index <= 9; $index++) { $reserved[] = 'COM' . $index; $reserved[] = 'LPT' . $index; } return !in_array($baseName, $reserved, true); } protected function removeDirectory($path) { if (!is_dir($path)) { return; } $iterator = new \RecursiveIteratorIterator( new \RecursiveDirectoryIterator($path, \FilesystemIterator::SKIP_DOTS), \RecursiveIteratorIterator::CHILD_FIRST ); foreach ($iterator as $item) { if ($item->isDir() && !$item->isLink()) { @rmdir($item->getPathname()); } else { @unlink($item->getPathname()); } } @rmdir($path); } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Definitions; use AMWScan\Filesystem\ResourceLocator; class DefinitionBundleStore { private const DEFAULT_METADATA_URL = 'https://api.github.com/repos/marcocesarato/PHP-Antimalware-Scanner/releases?per_page=100'; private const MANIFEST_MAX_BYTES = 65536; private const RELEASE_INDEX_MAX_BYTES = 524288; private const REFRESH_INTERVAL = 21600; private const RETAINED_RELEASES = 2; private $cachePath; private $bundledPath; private $downloader; private $activePath; private $metadata; private $usingBundled; private $archiveReader; private $metadataUrl; public function __construct($cachePath, $bundledPath = null, ?callable $downloader = null, $metadataUrl = null, $engineVersion = null) { $this->cachePath = rtrim((string)$cachePath, '/\\'); $this->bundledPath = rtrim( (string)($bundledPath === null ? (new ResourceLocator())->getBundledDatabasePath() : $bundledPath), '/\\' ); $this->downloader = $downloader ?: [$this, 'download']; $this->activePath = null; $this->metadata = null; $this->usingBundled = true; $this->archiveReader = new DefinitionArchiveReader($engineVersion); $configuredUrl = $metadataUrl === null ? getenv('AMWSCAN_DEFINITIONS_METADATA_URL') : $metadataUrl; $this->metadataUrl = is_string($configuredUrl) && $configuredUrl !== '' ? $configuredUrl : self::DEFAULT_METADATA_URL; } public function load() { if ($this->usesArchive()) { $this->loadArchive(); return; } $this->activate($this->bundledPath, true); $this->assertSafeCachePath(); $pointerPath = $this->cachePath . DIRECTORY_SEPARATOR . 'active.json'; if (!is_file($pointerPath)) { return; } if (is_link($pointerPath)) { throw new \RuntimeException('Cached AMWScan definition pointer must not be a symbolic link.'); } $contents = file_get_contents($pointerPath); $pointer = is_string($contents) ? json_decode($contents, true) : null; if (!is_array($pointer) || !isset($pointer['schemaVersion'], $pointer['provider'], $pointer['release'], $pointer['manifestSha256']) || $pointer['schemaVersion'] !== 1 || $pointer['provider'] !== 'amwscan' || !is_string($pointer['release']) || preg_match('/^[a-f0-9]{64}$/', $pointer['release']) !== 1 || !is_string($pointer['manifestSha256']) || $pointer['manifestSha256'] !== $pointer['release']) { throw new \RuntimeException('Cached AMWScan definition pointer is invalid.'); } $releasePath = $this->cachePath . DIRECTORY_SEPARATOR . 'releases' . DIRECTORY_SEPARATOR . $pointer['release']; $metadata = RuleData::validateDirectory($releasePath); if (!hash_equals($pointer['manifestSha256'], $metadata['manifestSha256'])) { throw new \RuntimeException('Cached AMWScan definition manifest checksum does not match.'); } if ($metadata['sequence'] < $this->metadata['sequence']) { throw new \RuntimeException('Cached AMWScan definitions are older than the embedded bundle.'); } $this->activate($releasePath, false, $metadata); } public function refresh() { if ($this->usesArchive()) { $this->refreshArchive(); return; } $this->ensureDirectory($this->cachePath); $lock = fopen($this->cachePath . DIRECTORY_SEPARATOR . 'update.lock', 'c+'); if ($lock === false || !flock($lock, LOCK_EX)) { if (is_resource($lock)) { fclose($lock); } throw new \RuntimeException('Unable to lock the AMWScan definition cache.'); } $staging = null; try { $pointerPath = $this->cachePath . DIRECTORY_SEPARATOR . 'active.json'; if (is_link($pointerPath)) { throw new \RuntimeException('Cached AMWScan definition pointer must not be a symbolic link.'); } try { $this->load(); } catch (\RuntimeException $error) { $this->activate($this->bundledPath, true); } if ($this->hasFreshCheck()) { return; } throw new \RuntimeException('Legacy directory definition updates are no longer supported.'); } finally { if ($staging !== null) { $this->removeDirectory($staging); } flock($lock, LOCK_UN); fclose($lock); } } public function getActivePath() { return $this->activePath; } public function getMetadata() { return $this->metadata; } public function isUsingBundled() { return $this->usingBundled; } public function isUpdateConfigured() { return is_string($this->metadataUrl) && $this->metadataUrl !== ''; } private function activate($path, $usingBundled, array $metadata = []) { $this->metadata = $metadata === [] ? RuleData::validateDirectory($path) : $metadata; $this->activePath = $path; $this->usingBundled = $usingBundled; } private function usesArchive() { return is_file($this->bundledPath); } private function loadArchive() { $this->activateArchive($this->bundledPath, true); $this->assertSafeCachePath(); $pointerPath = $this->cachePath . DIRECTORY_SEPARATOR . 'active.json'; if (!is_file($pointerPath)) { return; } if (is_link($pointerPath)) { throw new \RuntimeException('Cached AMWScan definition pointer must not be a symbolic link.'); } $contents = file_get_contents($pointerPath); $pointer = is_string($contents) ? json_decode($contents, true) : null; if (!is_array($pointer) || !isset($pointer['schemaVersion'], $pointer['provider'], $pointer['release'], $pointer['manifestSha256']) || $pointer['schemaVersion'] !== 1 || $pointer['provider'] !== 'amwscan' || !is_string($pointer['release']) || preg_match('/^[a-f0-9]{64}$/', $pointer['release']) !== 1 || !is_string($pointer['manifestSha256']) || preg_match('/^[a-f0-9]{64}$/', $pointer['manifestSha256']) !== 1) { throw new \RuntimeException('Cached AMWScan definition pointer is invalid.'); } $releasePath = $this->cachePath . DIRECTORY_SEPARATOR . 'releases' . DIRECTORY_SEPARATOR . $pointer['release'] . DIRECTORY_SEPARATOR . 'definitions.amwdb'; $bundle = $this->archiveReader->read($releasePath); if (!hash_equals($pointer['manifestSha256'], $bundle['metadata']['manifestSha256'])) { throw new \RuntimeException('Cached AMWScan definition manifest checksum does not match.'); } if ($bundle['metadata']['sequence'] < $this->metadata['sequence']) { throw new \RuntimeException('Cached AMWScan definitions are older than the embedded bundle.'); } $this->activateArchive($releasePath, false, $bundle); } private function refreshArchive() { $this->ensureDirectory($this->cachePath); $lock = fopen($this->cachePath . DIRECTORY_SEPARATOR . 'update.lock', 'c+'); if ($lock === false || !flock($lock, LOCK_EX)) { if (is_resource($lock)) { fclose($lock); } throw new \RuntimeException('Unable to lock the AMWScan definition cache.'); } $staging = null; try { try { $this->loadArchive(); } catch (\RuntimeException $error) { $this->activateArchive($this->bundledPath, true); } if ($this->hasFreshCheck() || !is_string($this->metadataUrl) || $this->metadataUrl === '') { return; } $metadataContents = $this->downloadContents($this->metadataUrl, self::RELEASE_INDEX_MAX_BYTES); $metadataUrl = $this->resolveMetadataUrl($metadataContents); if ($metadataUrl === null) { $this->writeCheck($this->metadata['manifestSha256']); return; } $remote = $this->decodeRemoteMetadata($this->downloadContents($metadataUrl, self::MANIFEST_MAX_BYTES)); if ($remote['sequence'] < $this->metadata['sequence']) { throw new \RuntimeException('Remote AMWScan definitions are older than the active bundle.'); } if ($remote['sequence'] === $this->metadata['sequence']) { $this->writeCheck($this->metadata['manifestSha256']); return; } $contents = $this->downloadContents($remote['download'], $remote['size']); if (strlen($contents) !== $remote['size'] || !hash_equals($remote['sha256'], hash('sha256', $contents))) { throw new \RuntimeException('Downloaded AMWDB archive checksum does not match.'); } $staging = $this->cachePath . DIRECTORY_SEPARATOR . 'staging-' . bin2hex(random_bytes(8)); $this->ensureDirectory($staging); $archivePath = $staging . DIRECTORY_SEPARATOR . 'definitions.amwdb'; $this->write($archivePath, $contents); $bundle = $this->archiveReader->read($archivePath); if ($bundle['metadata']['sequence'] !== $remote['sequence'] || $bundle['metadata']['version'] !== $remote['latest']) { throw new \RuntimeException('Downloaded AMWDB archive does not match release metadata.'); } $releases = $this->cachePath . DIRECTORY_SEPARATOR . 'releases'; $this->ensureDirectory($releases); $releasePath = $releases . DIRECTORY_SEPARATOR . $remote['sha256']; if (is_dir($releasePath)) { $this->archiveReader->read($releasePath . DIRECTORY_SEPARATOR . 'definitions.amwdb'); $this->removeDirectory($staging); $staging = null; } elseif (!rename($staging, $releasePath)) { throw new \RuntimeException('Unable to activate the downloaded AMWDB archive.'); } else { $staging = null; } $pointer = json_encode([ 'schemaVersion' => 1, 'provider' => 'amwscan', 'release' => $remote['sha256'], 'manifestSha256' => $bundle['metadata']['manifestSha256'], ], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES); if (!is_string($pointer)) { throw new \RuntimeException('Unable to encode the AMWScan definition pointer.'); } $temporary = $this->cachePath . DIRECTORY_SEPARATOR . 'active.json.tmp-' . bin2hex(random_bytes(4)); $this->write($temporary, $pointer . "\n"); if (!rename($temporary, $this->cachePath . DIRECTORY_SEPARATOR . 'active.json')) { @unlink($temporary); throw new \RuntimeException('Unable to update the AMWScan definition pointer.'); } $this->activateArchive($releasePath . DIRECTORY_SEPARATOR . 'definitions.amwdb', false, $bundle); $this->writeCheck($bundle['metadata']['manifestSha256']); $this->pruneReleases($remote['sha256']); } finally { if ($staging !== null) { $this->removeDirectory($staging); } flock($lock, LOCK_UN); fclose($lock); } } private function activateArchive($path, $usingBundled, array $bundle = []) { $bundle = $bundle === [] ? $this->archiveReader->read($path) : $bundle; $this->metadata = $bundle['metadata']; $this->activePath = $path; $this->usingBundled = $usingBundled; } private function decodeRemoteMetadata($contents) { $metadata = json_decode($contents, true); if (!is_array($metadata) || !isset($metadata['latest'], $metadata['sequence'], $metadata['download'], $metadata['sha256'], $metadata['size']) || !is_string($metadata['latest']) || preg_match('/^\d{4}\.\d{2}\.\d{2}\.\d+$/', $metadata['latest']) !== 1 || !is_int($metadata['sequence']) || $metadata['sequence'] < 1 || !is_string($metadata['download']) || filter_var($metadata['download'], FILTER_VALIDATE_URL) === false || strtolower((string)parse_url($metadata['download'], PHP_URL_SCHEME)) !== 'https' || !is_string($metadata['sha256']) || preg_match('/^[a-f0-9]{64}$/', $metadata['sha256']) !== 1 || !is_int($metadata['size']) || $metadata['size'] < 1 || $metadata['size'] > 16777216) { throw new \RuntimeException('AMWScan definition release metadata is invalid.'); } return $metadata; } private function resolveMetadataUrl($contents) { $data = json_decode($contents, true); if (is_array($data) && isset($data['latest'])) { return $this->metadataUrl; } if (!is_array($data)) { throw new \RuntimeException('GitHub definition release metadata is invalid.'); } foreach ($data as $release) { if (!is_array($release) || !isset($release['tag_name'], $release['assets']) || !is_string($release['tag_name']) || strpos($release['tag_name'], 'definitions-v') !== 0 || !is_array($release['assets'])) { continue; } foreach ($release['assets'] as $asset) { if (is_array($asset) && isset($asset['name'], $asset['browser_download_url']) && $asset['name'] === 'definitions.json' && filter_var($asset['browser_download_url'], FILTER_VALIDATE_URL) !== false && strtolower((string)parse_url($asset['browser_download_url'], PHP_URL_SCHEME)) === 'https') { return $asset['browser_download_url']; } } } return null; } private function downloadContents($url, $maxBytes) { $contents = call_user_func($this->downloader, $url, $maxBytes); if (!is_string($contents) || $contents === '' || strlen($contents) > $maxBytes) { throw new \RuntimeException('Unable to download AMWScan definitions within the size limit.'); } return $contents; } private function download($url, $maxBytes) { $context = stream_context_create(['http' => [ 'timeout' => 30, 'follow_location' => 0, 'header' => "User-Agent: AMWScan\r\nAccept: application/json\r\n", ]]); $handle = @fopen($url, 'rb', false, $context); if ($handle === false) { throw new \RuntimeException('Unable to download AMWScan definitions from GitHub.'); } try { $contents = stream_get_contents($handle, $maxBytes + 1); } finally { fclose($handle); } if (!is_string($contents) || strlen($contents) > $maxBytes) { throw new \RuntimeException('Downloaded AMWScan definitions exceed the size limit.'); } return $contents; } private function ensureDirectory($directory) { if (!is_dir($directory) && !mkdir($directory, 0700, true) && !is_dir($directory)) { throw new \RuntimeException('Unable to create the AMWScan definition cache directory.'); } if (is_link($directory)) { throw new \RuntimeException('AMWScan definition directories must not be symbolic links.'); } if (DIRECTORY_SEPARATOR !== '\\') { @chmod($directory, 0700); } } private function write($path, $contents) { if (is_link($path)) { throw new \RuntimeException('AMWScan definition cache files must not be symbolic links.'); } $written = file_put_contents($path, $contents, LOCK_EX); if ($written === false || $written !== strlen($contents)) { throw new \RuntimeException('Unable to write AMWScan definition cache data.'); } } private function assertSafeCachePath() { if ($this->cachePath !== '' && file_exists($this->cachePath) && is_link($this->cachePath)) { throw new \RuntimeException('AMWScan definition cache directory must not be a symbolic link.'); } } private function hasFreshCheck() { $path = $this->cachePath . DIRECTORY_SEPARATOR . 'last-check.json'; if (!is_file($path) || is_link($path)) { return false; } $contents = file_get_contents($path); $data = is_string($contents) ? json_decode($contents, true) : null; $age = is_array($data) && isset($data['checkedAt']) && is_int($data['checkedAt']) ? time() - $data['checkedAt'] : -1; return $age >= 0 && $age < self::REFRESH_INTERVAL && isset($data['manifestSha256']) && is_string($data['manifestSha256']) && hash_equals($this->metadata['manifestSha256'], $data['manifestSha256']); } private function writeCheck($manifestHash) { $contents = json_encode([ 'checkedAt' => time(), 'manifestSha256' => $manifestHash, ], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES); if (!is_string($contents)) { throw new \RuntimeException('Unable to encode AMWScan definition refresh metadata.'); } $this->write($this->cachePath . DIRECTORY_SEPARATOR . 'last-check.json', $contents . "\n"); } private function pruneReleases($activeHash) { $path = $this->cachePath . DIRECTORY_SEPARATOR . 'releases'; $releases = glob($path . DIRECTORY_SEPARATOR . '*', GLOB_ONLYDIR); if (!is_array($releases) || count($releases) <= self::RETAINED_RELEASES) { return; } usort($releases, static function ($left, $right) { return filemtime($right) <=> filemtime($left); }); $retained = 0; foreach ($releases as $release) { if (basename($release) === $activeHash || $retained < self::RETAINED_RELEASES - 1) { $retained++; continue; } $this->removeDirectory($release); } } private function removeDirectory($directory) { if (!is_dir($directory)) { return; } $iterator = new \RecursiveIteratorIterator( new \RecursiveDirectoryIterator($directory, \FilesystemIterator::SKIP_DOTS), \RecursiveIteratorIterator::CHILD_FIRST ); foreach ($iterator as $item) { $removed = $item->isDir() ? rmdir($item->getPathname()) : unlink($item->getPathname()); if (!$removed) { throw new \RuntimeException('Unable to remove stale AMWScan definition data.'); } } if (!rmdir($directory)) { throw new \RuntimeException('Unable to remove the AMWScan definition staging directory.'); } } } engineVersion = $engineVersion; } public function read($databasePath) { if (!is_file($databasePath) || is_link($databasePath) || filesize($databasePath) > self::MAX_COMPRESSED_BYTES) { throw new \RuntimeException('AMWDB archive is unavailable, unsafe, or exceeds the size limit.'); } $compressed = file_get_contents($databasePath); $contents = is_string($compressed) ? @gzdecode($compressed, self::MAX_UNCOMPRESSED_BYTES) : false; if (!is_string($contents) || $contents === '' || strlen($contents) > self::MAX_UNCOMPRESSED_BYTES) { throw new \RuntimeException('AMWDB archive is not a valid gzip-compressed TAR file.'); } $temporaryBase = tempnam(sys_get_temp_dir(), 'amwscan-amwdb-'); if ($temporaryBase === false) { throw new \RuntimeException('Unable to inspect the AMWDB archive.'); } if (!unlink($temporaryBase)) { throw new \RuntimeException('Unable to prepare the AMWDB archive inspection path.'); } $temporary = $temporaryBase . '.tar'; try { if (file_put_contents($temporary, $contents, LOCK_EX) !== strlen($contents)) { throw new \RuntimeException('Unable to inspect the AMWDB archive.'); } $archive = new \PharData($temporary); if (count($archive) !== count(self::REQUIRED_FILES)) { throw new \RuntimeException('AMWDB archive contains unexpected files.'); } $entries = []; foreach (self::REQUIRED_FILES as $file) { if (!isset($archive[$file])) { throw new \RuntimeException("AMWDB archive is missing '$file'."); } $entry = $archive[$file]; if ($entry->isDir() || $entry->isLink()) { throw new \RuntimeException("AMWDB archive entry '$file' is unsafe."); } $entryContents = file_get_contents($entry->getPathname()); if (!is_string($entryContents) || strlen($entryContents) > RuleData::MAX_FILE_BYTES) { throw new \RuntimeException("AMWDB archive entry '$file' is invalid or too large."); } $entries[$file] = $entryContents; } unset($archive); } finally { @unlink($temporary); } $metadata = RuleData::decodeManifest($entries['manifest.json']); if ($metadata['format'] !== 'amwdb') { throw new \RuntimeException('AMWDB archive manifest format is invalid.'); } $definitions = []; foreach ($metadata['files'] as $file => $details) { if (!isset($entries[$file]) || strlen($entries[$file]) !== $details['size'] || !hash_equals($details['sha256'], hash('sha256', $entries[$file]))) { throw new \RuntimeException("AMWDB archive entry '$file' checksum does not match."); } $definitions[substr($file, 0, -5)] = RuleData::validateContents(substr($file, 0, -5), $entries[$file]); } $this->assertEngineCompatibility($metadata); $metadata['manifestSha256'] = hash('sha256', $entries['manifest.json']); return ['metadata' => $metadata, 'definitions' => $definitions]; } private function assertEngineCompatibility(array $metadata) { if ($this->engineVersion === null) { return; } $compatibility = $metadata['compatibility']; if (version_compare($this->engineVersion, $compatibility['minEngineVersion'], '<') || ($compatibility['maxEngineVersion'] !== null && version_compare($this->engineVersion, $compatibility['maxEngineVersion'], '>'))) { throw new \RuntimeException('AMWDB archive is incompatible with this AMWScan engine version.'); } } } readSourceMetadata($sourceDirectory . DIRECTORY_SEPARATOR . 'metadata.json'); $definitions = []; $files = []; foreach (self::DATA_FILES as $file) { $path = $sourceDirectory . DIRECTORY_SEPARATOR . $file; if (!is_file($path) || is_link($path)) { throw new \RuntimeException("Definition source file '$file' is unavailable or unsafe."); } $contents = file_get_contents($path); if (!is_string($contents)) { throw new \RuntimeException("Definition source file '$file' cannot be read."); } $definitions[substr($file, 0, -5)] = RuleData::validateContents(substr($file, 0, -5), $contents); $files[$file] = ['size' => strlen($contents), 'sha256' => hash('sha256', $contents)]; } $manifest = [ 'format' => 'amwdb', 'schemaVersion' => RuleData::SCHEMA_VERSION, 'provider' => 'amwscan', 'version' => $sourceMetadata['version'], 'sequence' => $sourceMetadata['sequence'], 'createdAt' => gmdate('Y-m-d\TH:i:s\Z'), 'compatibility' => $sourceMetadata['compatibility'], 'statistics' => [ 'signatures' => count($definitions['signatures']['raw']) + count($definitions['signatures']['regex']), 'exploits' => count($definitions['exploits']['default']) + count($definitions['exploits']['javascript']), 'functions' => count($definitions['functions']['default']) + count($definitions['functions']['dangerous']), 'hashes' => count($definitions['hashes']['knownMalwareSha256']) + $definitions['hashes']['knownMalwareMd5Prefixes']['count'] + $definitions['hashes']['legacyCoreSha256']['count'], ], 'files' => $files, ]; $manifestContents = json_encode($manifest, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES); if (!is_string($manifestContents)) { throw new \RuntimeException('Unable to encode the AMWScan definition manifest.'); } $manifestContents .= "\n"; $destination = dirname($databasePath); if (!is_dir($destination) && !mkdir($destination, 0700, true) && !is_dir($destination)) { throw new \RuntimeException('Unable to create the AMWDB destination directory.'); } $temporaryBase = tempnam($destination, 'amwscan-build-'); if ($temporaryBase === false) { throw new \RuntimeException('Unable to create a temporary AMWDB archive.'); } if (!unlink($temporaryBase)) { throw new \RuntimeException('Unable to prepare a temporary AMWDB archive.'); } $temporaryTar = $temporaryBase . '.tar'; $temporaryDatabase = $databasePath . '.tmp-' . bin2hex(random_bytes(8)); try { $archive = new \PharData($temporaryTar); $archive->addFromString('manifest.json', $manifestContents); foreach (self::DATA_FILES as $file) { $archive->addFile($sourceDirectory . DIRECTORY_SEPARATOR . $file, $file); } unset($archive); $tarContents = file_get_contents($temporaryTar); $compressed = is_string($tarContents) ? gzencode($tarContents, 9) : false; if (!is_string($compressed) || file_put_contents($temporaryDatabase, $compressed, LOCK_EX) !== strlen($compressed)) { throw new \RuntimeException('Unable to write the AMWDB archive.'); } if (!rename($temporaryDatabase, $databasePath)) { throw new \RuntimeException('Unable to activate the AMWDB archive.'); } } finally { @unlink($temporaryTar); @unlink($temporaryDatabase); } return RuleData::decodeManifest($manifestContents); } private function readSourceMetadata($path) { if (!is_file($path) || is_link($path)) { throw new \RuntimeException('Definition source metadata is unavailable or unsafe.'); } $contents = file_get_contents($path); $data = is_string($contents) ? json_decode($contents, true) : null; if (!is_array($data) || json_last_error() !== JSON_ERROR_NONE || !isset($data['schemaVersion'], $data['provider'], $data['version'], $data['sequence'], $data['compatibility']) || $data['schemaVersion'] !== RuleData::SCHEMA_VERSION || $data['provider'] !== 'amwscan' || !is_string($data['version']) || preg_match('/^\d{4}\.\d{2}\.\d{2}\.\d+$/', $data['version']) !== 1 || !is_int($data['sequence']) || $data['sequence'] < 1 || !is_array($data['compatibility'])) { throw new \RuntimeException('Definition source metadata is invalid.'); } $compatibility = $data['compatibility']; if (!isset($compatibility['minEngineVersion']) || !is_string($compatibility['minEngineVersion']) || !array_key_exists('maxEngineVersion', $compatibility) || ($compatibility['maxEngineVersion'] !== null && !is_string($compatibility['maxEngineVersion']))) { throw new \RuntimeException('Definition source compatibility metadata is invalid.'); } return [ 'version' => $data['version'], 'sequence' => $data['sequence'], 'compatibility' => [ 'minEngineVersion' => $compatibility['minEngineVersion'], 'maxEngineVersion' => $compatibility['maxEngineVersion'], ], ]; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Definitions; use AMWScan\Filesystem\ResourceLocator; class RuleData { public const SCHEMA_VERSION = 1; public const MAX_FILE_BYTES = 8388608; public const MAX_LIST_ITEMS = 1000000; public const MAX_STRING_BYTES = 262144; public const MAX_SIGNATURE_RULES = 20000; public const MAX_EXPLOITS = 1000; private static $directory; private static $definitions; private static $supportedNames = ['signatures', 'exploits', 'hashes', 'functions']; private static $validatedRegexHashes = [ 'signatures' => '4b25913d8f99d01b166eb57ec2952057e598ee3f1de4c00aee21ee3075465be8', 'exploits' => '550a763ba9b519a1c098cd4fac2a483e7a8f1fd75281a84f93568d97be5e93f8', ]; public static function load($name) { self::assertSupportedName($name); if (self::$definitions === null && self::$directory === null) { self::useArchive((new ResourceLocator())->getBundledDatabasePath()); } if (self::$definitions !== null) { return self::$definitions[$name]; } return self::loadFile(self::getDirectory() . DIRECTORY_SEPARATOR . $name . '.json', $name); } public static function getEmbeddedDirectory() { return (new ResourceLocator())->getSourceDirectory(); } public static function getDirectory() { return self::$directory === null ? self::getEmbeddedDirectory() : self::$directory; } public static function useDirectory($directory) { $metadata = self::validateDirectory($directory); self::$directory = rtrim($directory, '/\\'); self::$definitions = null; return $metadata; } public static function useArchive($archivePath, $engineVersion = null) { $bundle = (new DefinitionArchiveReader($engineVersion))->read($archivePath); self::$directory = null; self::$definitions = $bundle['definitions']; return $bundle['metadata']; } public static function useDefinitions(array $definitions) { foreach (self::$supportedNames as $name) { if (!isset($definitions[$name]) || !is_array($definitions[$name])) { throw new \RuntimeException("Definition collection '$name' is invalid."); } } self::$directory = null; self::$definitions = $definitions; } public static function resetDirectory() { self::$directory = null; self::$definitions = null; } public static function validateDirectory($directory) { $directory = rtrim((string)$directory, '/\\'); if ($directory === '' || !is_dir($directory) || is_link($directory)) { throw new \RuntimeException('Definition bundle directory is unavailable or unsafe.'); } $manifestPath = $directory . DIRECTORY_SEPARATOR . 'manifest.json'; if (is_link($manifestPath)) { throw new \RuntimeException('Definition bundle manifest must not be a symbolic link.'); } $contents = @file_get_contents($manifestPath); if (!is_string($contents)) { throw new \RuntimeException('Definition bundle manifest cannot be read.'); } $metadata = self::decodeManifest($contents); foreach ($metadata['files'] as $name => $file) { $path = $directory . DIRECTORY_SEPARATOR . $name; if (!is_file($path) || is_link($path) || filesize($path) !== $file['size']) { throw new \RuntimeException("Definition bundle file '$name' has an invalid size."); } $hash = hash_file('sha256', $path); if (!is_string($hash) || !hash_equals($file['sha256'], $hash)) { throw new \RuntimeException("Definition bundle file '$name' checksum does not match."); } self::loadFile($path, substr($name, 0, -5)); } $metadata['manifestSha256'] = hash('sha256', $contents); return $metadata; } public static function decodeManifest($contents) { $data = json_decode($contents); if (!$data instanceof \stdClass || json_last_error() !== JSON_ERROR_NONE) { throw new \RuntimeException('Definition bundle manifest must contain valid JSON.'); } foreach (['schemaVersion', 'provider', 'version', 'sequence', 'files'] as $property) { if (!property_exists($data, $property)) { throw new \RuntimeException("Definition bundle manifest is missing '$property'."); } } if ($data->schemaVersion !== self::SCHEMA_VERSION || $data->provider !== 'amwscan') { throw new \RuntimeException('Definition bundle manifest identity is invalid.'); } if (!is_string($data->version) || preg_match('/^\d{4}\.\d{2}\.\d{2}\.\d+$/', $data->version) !== 1) { throw new \RuntimeException('Definition bundle version is invalid.'); } if (!is_int($data->sequence) || $data->sequence < 1 || !$data->files instanceof \stdClass) { throw new \RuntimeException('Definition bundle sequence or files are invalid.'); } $files = []; $expected = ['signatures.json', 'exploits.json', 'hashes.json', 'functions.json']; if (array_keys(get_object_vars($data->files)) !== $expected) { throw new \RuntimeException('Definition bundle file list is invalid or unordered.'); } foreach (get_object_vars($data->files) as $name => $file) { if (!$file instanceof \stdClass || !property_exists($file, 'size') || !is_int($file->size) || $file->size < 1 || $file->size > self::MAX_FILE_BYTES || !property_exists($file, 'sha256') || !is_string($file->sha256) || preg_match('/^[a-f0-9]{64}$/', $file->sha256) !== 1) { throw new \RuntimeException("Definition bundle metadata for '$name' is invalid."); } $files[$name] = ['size' => $file->size, 'sha256' => $file->sha256]; } $format = property_exists($data, 'format') ? $data->format : 'directory'; if (!is_string($format) || !in_array($format, ['directory', 'amwdb'], true)) { throw new \RuntimeException('Definition bundle format is invalid.'); } $compatibility = [ 'minEngineVersion' => '0.0.0', 'maxEngineVersion' => null, ]; if (property_exists($data, 'compatibility')) { if (!$data->compatibility instanceof \stdClass || !property_exists($data->compatibility, 'minEngineVersion') || !property_exists($data->compatibility, 'maxEngineVersion') || !is_string($data->compatibility->minEngineVersion) || ($data->compatibility->maxEngineVersion !== null && !is_string($data->compatibility->maxEngineVersion))) { throw new \RuntimeException('Definition bundle compatibility is invalid.'); } $compatibility = [ 'minEngineVersion' => $data->compatibility->minEngineVersion, 'maxEngineVersion' => $data->compatibility->maxEngineVersion, ]; } return [ 'format' => $format, 'schemaVersion' => self::SCHEMA_VERSION, 'provider' => 'amwscan', 'version' => $data->version, 'sequence' => $data->sequence, 'compatibility' => $compatibility, 'files' => $files, ]; } protected static function loadFile($path, $name) { self::assertSupportedName($name); $contents = @file_get_contents($path); if ($contents === false) { throw new \RuntimeException('Unable to read rule data file: ' . $path); } return self::validateContents($name, $contents); } public static function validateContents($name, $contents) { self::assertSupportedName($name); $data = json_decode($contents); if (!$data instanceof \stdClass || json_last_error() !== JSON_ERROR_NONE) { throw new \RuntimeException('Rule data must contain valid JSON: ' . json_last_error_msg()); } if (!property_exists($data, 'schemaVersion') || $data->schemaVersion !== self::SCHEMA_VERSION) { throw new \RuntimeException('Unsupported rule data schema version.'); } if ($name === 'signatures') { return self::validateSignatures($data); } if ($name === 'hashes') { return self::validateHashes($data); } if ($name === 'functions') { return self::validateFunctions($data); } return self::validateExploits($data); } private static function validateSignatures(\stdClass $data) { self::assertObjectKeys($data, ['schemaVersion', 'domains', 'raw', 'regex'], 'signatures'); $domains = self::stringList($data, 'domains', self::MAX_SIGNATURE_RULES); $raw = self::stringList($data, 'raw', self::MAX_SIGNATURE_RULES); $regex = self::stringList($data, 'regex', self::MAX_SIGNATURE_RULES); if (!self::matchesValidatedRegexHash('signatures', $regex)) { foreach ($regex as $index => $pattern) { self::assertRegex('#' . $pattern . '#smiS', 'signature ' . $index); } } return [ 'schemaVersion' => self::SCHEMA_VERSION, 'domains' => $domains, 'raw' => $raw, 'regex' => $regex, ]; } private static function validateExploits(\stdClass $data) { $expectedKeys = property_exists($data, 'javascript') ? ['schemaVersion', 'default', 'javascript', 'liteOverrides', 'liteExclusions'] : ['schemaVersion', 'default', 'liteOverrides', 'liteExclusions']; self::assertObjectKeys($data, $expectedKeys, 'exploits'); $default = self::exploitMap($data, 'default', true); $javascript = property_exists($data, 'javascript') ? self::exploitMap($data, 'javascript', true) : []; $overrides = self::exploitMap($data, 'liteOverrides', false); $exclusions = self::stringList($data, 'liteExclusions'); $patterns = []; foreach ($default as $name => $definition) { $patterns['default:' . $name] = $definition['pattern']; } foreach ($javascript as $name => $definition) { $patterns['javascript:' . $name] = $definition['pattern']; } foreach ($overrides as $name => $definition) { if (!isset($default[$name])) { throw new \RuntimeException("Lite override references unknown exploit '$name'."); } if (isset($definition['pattern'])) { $patterns['lite:' . $name] = $definition['pattern']; } } foreach ($exclusions as $name) { if (!isset($default[$name])) { throw new \RuntimeException("Lite exclusion references unknown exploit '$name'."); } } if (!self::matchesValidatedRegexHash('exploits', $patterns)) { foreach ($patterns as $name => $pattern) { self::assertRegex($pattern, "exploit '$name'"); } } return [ 'schemaVersion' => self::SCHEMA_VERSION, 'default' => $default, 'javascript' => $javascript, 'liteOverrides' => $overrides, 'liteExclusions' => $exclusions, ]; } private static function validateHashes(\stdClass $data) { self::assertObjectKeys( $data, ['schemaVersion', 'knownMalwareSha256', 'knownMalwareMd5Prefixes', 'legacyCoreSha256'], 'hashes' ); $knownMalware = self::stringList($data, 'knownMalwareSha256'); self::assertSortedHexRecords($knownMalware, 64, 'knownMalwareSha256'); $md5Prefixes = self::hashIndex($data, 'knownMalwareMd5Prefixes', 8); $legacyCore = self::hashIndex($data, 'legacyCoreSha256', 64); return [ 'schemaVersion' => self::SCHEMA_VERSION, 'knownMalwareSha256' => $knownMalware, 'knownMalwareMd5Prefixes' => $md5Prefixes, 'legacyCoreSha256' => $legacyCore, ]; } private static function validateFunctions(\stdClass $data) { self::assertObjectKeys($data, ['schemaVersion', 'default', 'dangerous'], 'functions'); return [ 'schemaVersion' => self::SCHEMA_VERSION, 'default' => self::stringList($data, 'default', self::MAX_SIGNATURE_RULES), 'dangerous' => self::stringList($data, 'dangerous', self::MAX_SIGNATURE_RULES), ]; } private static function hashIndex(\stdClass $data, $property, $expectedWidth) { $index = self::requiredProperty($data, $property); if (!$index instanceof \stdClass) { throw new \RuntimeException("Hash index '$property' must be an object."); } self::assertObjectKeys($index, ['count', 'recordHexCharacters', 'sha256', 'chunks'], $property); if (!is_int($index->count) || $index->count < 1 || $index->count > self::MAX_LIST_ITEMS || $index->recordHexCharacters !== $expectedWidth || !is_string($index->sha256) || preg_match('/^[a-f0-9]{64}$/', $index->sha256) !== 1) { throw new \RuntimeException("Hash index '$property' metadata is invalid."); } $chunks = self::stringList($index, 'chunks'); $hex = implode('', $chunks); if (strlen($hex) !== $index->count * $expectedWidth || preg_match('/^[a-f0-9]+$/', $hex) !== 1) { throw new \RuntimeException("Hash index '$property' record data is invalid."); } $records = str_split($hex, $expectedWidth); self::assertSortedHexRecords($records, $expectedWidth, $property); $binary = hex2bin($hex); if (!is_string($binary) || !hash_equals($index->sha256, hash('sha256', $binary))) { throw new \RuntimeException("Hash index '$property' checksum does not match."); } return [ 'count' => $index->count, 'recordHexCharacters' => $expectedWidth, 'sha256' => $index->sha256, 'chunks' => $chunks, ]; } private static function assertSortedHexRecords(array $records, $width, $name) { $previous = null; foreach ($records as $record) { if (!is_string($record) || strlen($record) !== $width || preg_match('/^[a-f0-9]+$/', $record) !== 1 || ($previous !== null && strcmp($previous, $record) >= 0)) { throw new \RuntimeException("Hash records '$name' are invalid or unsorted."); } $previous = $record; } } private static function exploitMap(\stdClass $data, $property, $requireAllFields) { $value = self::requiredProperty($data, $property); if (!$value instanceof \stdClass) { throw new \RuntimeException("Rule data field '$property' must be an object."); } $definitions = []; foreach (get_object_vars($value) as $name => $definition) { if (!$definition instanceof \stdClass) { throw new \RuntimeException("Exploit '$name' must be an object."); } $definitions[$name] = self::exploitDefinition($name, $definition, $requireAllFields); } if (count($definitions) > self::MAX_EXPLOITS) { throw new \RuntimeException("Rule data field '$property' contains too many exploits."); } return $definitions; } private static function exploitDefinition($name, \stdClass $definition, $requireAllFields) { $allowed = ['description', 'level', 'pattern', 'link']; $properties = get_object_vars($definition); if ($properties === []) { throw new \RuntimeException("Exploit '$name' must define at least one field."); } foreach (array_keys($properties) as $property) { if (!in_array($property, $allowed, true)) { throw new \RuntimeException("Exploit '$name' contains unsupported field '$property'."); } } if ($requireAllFields) { foreach (['description', 'level', 'pattern'] as $property) { if (!property_exists($definition, $property)) { throw new \RuntimeException("Exploit '$name' is missing required field '$property'."); } } } foreach ($properties as $property => $value) { if (!is_string($value)) { throw new \RuntimeException("Exploit '$name' field '$property' must be a string."); } } return $properties; } private static function matchesValidatedRegexHash($name, array $patterns) { return hash_equals(self::$validatedRegexHashes[$name], hash('sha256', serialize($patterns))); } private static function stringList(\stdClass $data, $property, $maxItems = self::MAX_LIST_ITEMS) { $value = self::requiredProperty($data, $property); if (!is_array($value) || count($value) > $maxItems) { throw new \RuntimeException("Rule data field '$property' must be a list."); } foreach ($value as $index => $item) { if (!is_string($item) || strlen($item) > self::MAX_STRING_BYTES) { throw new \RuntimeException("Rule data field '$property' contains a non-string value at index $index."); } } return $value; } private static function requiredProperty(\stdClass $data, $property) { if (!property_exists($data, $property)) { throw new \RuntimeException("Rule data is missing required field '$property'."); } return $data->{$property}; } private static function assertObjectKeys(\stdClass $data, array $expected, $name) { $properties = get_object_vars($data); foreach ($expected as $property) { if (!array_key_exists($property, $properties)) { throw new \RuntimeException("Rule data is missing required field '$property'."); } } if (array_keys($properties) !== $expected) { throw new \RuntimeException("Rule data '$name' has invalid or unordered fields."); } } private static function assertRegex($pattern, $name) { $warning = null; set_error_handler(function ($severity, $message) use (&$warning) { $warning = $message; return true; }); try { $result = preg_match($pattern, ''); } finally { restore_error_handler(); } if ($result === false) { throw new \RuntimeException("Invalid regular expression for $name: $warning"); } } private static function assertSupportedName($name) { if (!is_string($name) || !in_array($name, self::$supportedNames, true)) { throw new \RuntimeException('Unsupported rule data name.'); } } } path = rtrim((string)($path ?: self::getDefaultPath()), '/\\'); } public static function getDefaultPath() { $base = getenv('APPDATA'); if (!is_string($base) || $base === '') { $home = getenv('HOME'); $base = is_string($home) && $home !== '' ? $home . DIRECTORY_SEPARATOR . '.config' : sys_get_temp_dir(); } return $base . DIRECTORY_SEPARATOR . 'amwscan' . DIRECTORY_SEPARATOR . 'rules'; } public function merge(array $official) { foreach (self::NAMES as $name) { if (!isset($official[$name]) || !is_array($official[$name])) { throw new \RuntimeException("Official definition '$name' is invalid."); } } $definitions = $official; $localSignatures = $this->load('signatures'); if ($localSignatures !== null) { foreach (['domains', 'raw', 'regex'] as $property) { $definitions['signatures'][$property] = array_values(array_unique(array_merge( $definitions['signatures'][$property], $localSignatures[$property] ))); } } $localExploits = $this->load('exploits'); if ($localExploits !== null) { $definitions['exploits']['javascript'] = array_replace( isset($definitions['exploits']['javascript']) ? $definitions['exploits']['javascript'] : [], isset($localExploits['javascript']) ? $localExploits['javascript'] : [] ); $definitions['exploits']['default'] = array_replace( $definitions['exploits']['default'], $localExploits['default'] ); $definitions['exploits']['liteOverrides'] = array_replace( $definitions['exploits']['liteOverrides'], $localExploits['liteOverrides'] ); $definitions['exploits']['liteExclusions'] = array_values(array_unique(array_merge( $definitions['exploits']['liteExclusions'], $localExploits['liteExclusions'] ))); } $localHashes = $this->load('hashes'); if ($localHashes !== null) { $definitions['hashes'] = $this->mergeHashes($definitions['hashes'], $localHashes); } $localFunctions = $this->load('functions'); if ($localFunctions !== null) { foreach (['default', 'dangerous'] as $property) { $definitions['functions'][$property] = array_values(array_unique(array_merge( $definitions['functions'][$property], $localFunctions[$property] ))); } } foreach ($this->disabledRules() as $rule) { if (strpos($rule, 'exploit:') === 0) { $name = substr($rule, 8); unset($definitions['exploits']['default'][$name], $definitions['exploits']['liteOverrides'][$name]); $definitions['exploits']['liteExclusions'] = array_values(array_diff( $definitions['exploits']['liteExclusions'], [$name] )); } } return $definitions; } public function disable($rule) { if (!is_string($rule) || preg_match('/^exploit:[A-Za-z0-9_.-]+$/', $rule) !== 1) { throw new \InvalidArgumentException('Only exploit: rule identifiers can be disabled.'); } if (!is_dir($this->path) && !mkdir($this->path, 0700, true) && !is_dir($this->path)) { throw new \RuntimeException('Unable to create the local AMWScan rule directory.'); } if (is_link($this->path)) { throw new \RuntimeException('Local AMWScan rule directory must not be a symbolic link.'); } $rules = $this->disabledRules(); if (!in_array($rule, $rules, true)) { $rules[] = $rule; } $contents = json_encode(['disabledRules' => $rules], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES); if (!is_string($contents)) { throw new \RuntimeException('Unable to encode the local disabled-rule list.'); } $temporary = $this->path . DIRECTORY_SEPARATOR . 'disabled.json.tmp-' . bin2hex(random_bytes(4)); if (file_put_contents($temporary, $contents . "\n", LOCK_EX) !== strlen($contents) + 1 || !rename($temporary, $this->path . DIRECTORY_SEPARATOR . 'disabled.json')) { @unlink($temporary); throw new \RuntimeException('Unable to update the local disabled-rule list.'); } } public function getDisabledRules() { return $this->disabledRules(); } public function enable($rule) { if (!is_string($rule) || preg_match('/^exploit:[A-Za-z0-9_.-]+$/', $rule) !== 1) { throw new \InvalidArgumentException('Only exploit: rule identifiers can be enabled.'); } $rules = array_values(array_diff($this->disabledRules(), [$rule])); if ($rules === [] && !is_file($this->path . DIRECTORY_SEPARATOR . 'disabled.json')) { return; } $contents = json_encode(['disabledRules' => $rules], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES); if (!is_string($contents)) { throw new \RuntimeException('Unable to encode the local disabled-rule list.'); } $temporary = $this->path . DIRECTORY_SEPARATOR . 'disabled.json.tmp-' . bin2hex(random_bytes(4)); if (file_put_contents($temporary, $contents . "\n", LOCK_EX) !== strlen($contents) + 1 || !rename($temporary, $this->path . DIRECTORY_SEPARATOR . 'disabled.json')) { @unlink($temporary); throw new \RuntimeException('Unable to update the local disabled-rule list.'); } } private function load($name) { $path = $this->path . DIRECTORY_SEPARATOR . $name . '.json'; if (!is_file($path)) { return null; } if (is_link($path)) { throw new \RuntimeException("Local definition '$name' must not be a symbolic link."); } $contents = file_get_contents($path); if (!is_string($contents)) { throw new \RuntimeException("Local definition '$name' cannot be read."); } return RuleData::validateContents($name, $contents); } private function disabledRules() { $path = $this->path . DIRECTORY_SEPARATOR . 'disabled.json'; if (!is_file($path)) { return []; } if (is_link($path)) { throw new \RuntimeException('Local disabled-rule list must not be a symbolic link.'); } $contents = file_get_contents($path); $data = is_string($contents) ? json_decode($contents, true) : null; if (!is_array($data) || !isset($data['disabledRules']) || !is_array($data['disabledRules'])) { throw new \RuntimeException('Local disabled-rule list is invalid.'); } foreach ($data['disabledRules'] as $rule) { if (!is_string($rule) || preg_match('/^exploit:[A-Za-z0-9_.-]+$/', $rule) !== 1) { throw new \RuntimeException('Local disabled rule identifier is invalid.'); } } return array_values(array_unique($data['disabledRules'])); } private function mergeHashes(array $official, array $local) { $merged = $official; $merged['knownMalwareSha256'] = $this->mergeRecords( $official['knownMalwareSha256'], $local['knownMalwareSha256'], 64 ); foreach (['knownMalwareMd5Prefixes', 'legacyCoreSha256'] as $name) { $width = $official[$name]['recordHexCharacters']; if ($local[$name]['recordHexCharacters'] !== $width) { throw new \RuntimeException("Local hash index '$name' has an incompatible record width."); } $records = $this->mergeRecords( str_split(implode('', $official[$name]['chunks']), $width), str_split(implode('', $local[$name]['chunks']), $width), $width ); $hex = implode('', $records); $merged[$name] = [ 'count' => count($records), 'recordHexCharacters' => $width, 'sha256' => hash('sha256', hex2bin($hex)), 'chunks' => [$hex], ]; } return $merged; } private function mergeRecords(array $official, array $local, $width) { $records = array_values(array_unique(array_merge($official, $local))); sort($records, SORT_STRING); foreach ($records as $record) { if (strlen($record) !== $width) { throw new \RuntimeException('Local hash record has an invalid width.'); } } return $records; } } self::MAX_SAFE_ANALYSIS_BYTES; } public static function finding($path, $size) { if (!is_int($size) || $size <= self::MAX_SAFE_ANALYSIS_BYTES || !self::isScriptPath($path)) { return null; } return [ 'key' => 'oversized_script_file', 'level' => CodeMatch::WARNING, 'description' => 'This unusually large script may conceal malicious code. Only a bounded raw-signature screening was performed to protect scanner stability; review it manually.', 'line' => 1, 'offset' => 0, 'match' => sprintf( 'File size: %d bytes; automatic scan limit: %d bytes', $size, self::MAX_SAFE_ANALYSIS_BYTES ), ]; } private static function isScriptPath($path) { if (!is_string($path) || $path === '') { return false; } $extension = strtolower(pathinfo($path, PATHINFO_EXTENSION)); return in_array($extension, [ 'php', 'php3', 'ph3', 'php4', 'ph4', 'php5', 'ph5', 'php7', 'ph7', 'php8', 'ph8', 'pht', 'phtm', 'phtml', 'inc', 'module', 'install', 'theme', 'js', 'cjs', 'mjs', 'jsx', 'ts', 'tsx', ], true); } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Scan; use AMWScan\Filesystem\AtomicFile; class ArchiveScanner { private $limits; public function __construct(array $limits = []) { $this->limits = array_merge([ 'max_entries' => 2000, 'max_entry_bytes' => 16777216, 'max_expanded_bytes' => 134217728, 'max_ratio' => 200, 'max_depth' => 2, ], $limits); foreach ($this->limits as $name => $value) { if (!is_int($value) || $value < 1) { throw new \InvalidArgumentException(sprintf('Archive limit "%s" must be a positive integer.', $name)); } } } public function scan($archivePath, callable $scanner) { if (!class_exists('ZipArchive')) { throw new \RuntimeException('ZIP archive scanning requires the zip extension.'); } if (!is_file($archivePath) || is_link($archivePath)) { throw new \InvalidArgumentException('Archive path must be a regular file.'); } $budget = ['entries' => 0, 'expanded_bytes' => 0]; return $this->scanZip($archivePath, $archivePath, $scanner, 0, $budget); } public function scanEntries(array $entries, $archiveLabel, callable $scanner, $depth = 0) { $budget = ['entries' => 0, 'expanded_bytes' => 0]; return $this->processEntries($entries, $archiveLabel, $scanner, $depth, $budget); } private function processEntries(array $entries, $archiveLabel, callable $scanner, $depth, array &$budget) { $coverage = $this->emptyCoverage(); $findings = []; foreach ($entries as $entry) { if ($budget['entries'] >= $this->limits['max_entries']) { $coverage['skipped']++; $coverage['reasons']['entry_limit']++; continue; } $budget['entries']++; $coverage['discovered']++; if (!is_array($entry) || !isset($entry['name'], $entry['compressed_size'])) { $coverage['skipped']++; $coverage['reasons']['unreadable']++; continue; } $name = $this->safePath($entry['name']); if ($name === null) { $coverage['skipped']++; $coverage['reasons']['unsafe_path']++; continue; } if (!empty($entry['symlink'])) { $coverage['skipped']++; $coverage['reasons']['symlink']++; continue; } $content = isset($entry['content']) ? $entry['content'] : null; $size = isset($entry['size']) ? (int)$entry['size'] : (is_string($content) ? strlen($content) : -1); if ($size > $this->limits['max_entry_bytes'] || $budget['expanded_bytes'] + $size > $this->limits['max_expanded_bytes']) { $coverage['skipped']++; $coverage['reasons']['oversized']++; continue; } $compressedSize = max(1, (int)$entry['compressed_size']); if ($size / $compressedSize > $this->limits['max_ratio']) { $coverage['skipped']++; $coverage['reasons']['compression_ratio']++; continue; } if (!is_string($content) && isset($entry['loader']) && is_callable($entry['loader'])) { $content = call_user_func($entry['loader']); } if (!is_string($content)) { $coverage['skipped']++; $coverage['reasons']['unreadable']++; continue; } $actualSize = strlen($content); if ($actualSize > $this->limits['max_entry_bytes'] || $budget['expanded_bytes'] + $actualSize > $this->limits['max_expanded_bytes'] || $actualSize / $compressedSize > $this->limits['max_ratio']) { $coverage['skipped']++; $coverage['reasons'][$actualSize / $compressedSize > $this->limits['max_ratio'] ? 'compression_ratio' : 'oversized']++; continue; } $budget['expanded_bytes'] += $actualSize; $virtualPath = $archiveLabel . '!' . $name; if (strtolower(pathinfo($name, PATHINFO_EXTENSION)) === 'zip') { if ($depth >= $this->limits['max_depth'] || !class_exists('ZipArchive')) { $coverage['skipped']++; $coverage['reasons']['nested_limit']++; continue; } $nested = $this->scanNested($content, $virtualPath, $scanner, $depth + 1, $budget); $findings = array_merge($findings, $nested['findings']); $coverage = $this->mergeCoverage($coverage, $nested['coverage']); continue; } try { $matches = call_user_func($scanner, $content, $virtualPath); if (!is_array($matches)) { throw new \RuntimeException('Archive scanner callback returned invalid data.'); } $findings = array_merge($findings, $matches); $coverage['scanned']++; } catch (\Throwable $exception) { $coverage['skipped']++; $coverage['reasons']['errors']++; } } $coverage['complete'] = $coverage['skipped'] === 0; return ['findings' => $findings, 'coverage' => $coverage]; } private function scanZip($path, $label, callable $scanner, $depth, array &$budget) { $zip = new \ZipArchive(); if ($zip->open($path) !== true) { throw new \RuntimeException(sprintf('Unable to open archive "%s".', $label)); } $coverage = $this->emptyCoverage(); $findings = []; try { for ($index = 0; $index < $zip->numFiles; $index++) { if ($budget['entries'] >= $this->limits['max_entries']) { $remaining = $zip->numFiles - $index; $coverage['skipped'] += $remaining; $coverage['reasons']['entry_limit'] += $remaining; break; } $stat = $zip->statIndex($index); if (!is_array($stat)) { $budget['entries']++; $coverage['discovered']++; $coverage['skipped']++; $coverage['reasons']['unreadable']++; continue; } if (substr($stat['name'], -1) === '/') { continue; } $symlink = false; if (method_exists($zip, 'getExternalAttributesIndex')) { $operations = 0; $attributes = 0; if ($zip->getExternalAttributesIndex($index, $operations, $attributes)) { $symlink = (($attributes >> 16) & 0170000) === 0120000; } } $entry = [ 'name' => $stat['name'], 'size' => isset($stat['size']) ? $stat['size'] : -1, 'compressed_size' => isset($stat['comp_size']) ? $stat['comp_size'] : 0, 'symlink' => $symlink, 'loader' => static function () use ($zip, $index) { return $zip->getFromIndex($index); }, ]; $result = $this->processEntries([$entry], $label, $scanner, $depth, $budget); $findings = array_merge($findings, $result['findings']); $coverage = $this->mergeCoverage($coverage, $result['coverage']); } } finally { $zip->close(); } $coverage['complete'] = $coverage['skipped'] === 0; return ['findings' => $findings, 'coverage' => $coverage]; } private function scanNested($content, $label, callable $scanner, $depth, array &$budget) { $temporary = tempnam(sys_get_temp_dir(), 'amwscan-archive-'); if ($temporary === false) { throw new \RuntimeException('Unable to allocate nested archive storage.'); } @unlink($temporary); try { AtomicFile::replaceContentsAtomically($temporary, $content, false); } catch (\Throwable $exception) { if (is_string($temporary)) { @unlink($temporary); } throw new \RuntimeException('Unable to stage nested archive.', 0, $exception); } @chmod($temporary, 0600); try { return $this->scanZip($temporary, $label, $scanner, $depth, $budget); } finally { @unlink($temporary); } } private function safePath($path) { if (!is_string($path) || $path === '' || strpos($path, "\0") !== false) { return null; } $path = str_replace('\\', '/', $path); if ($path[0] === '/' || preg_match('/^[a-z]:\//i', $path)) { return null; } foreach (explode('/', $path) as $segment) { if ($segment === '' || $segment === '.' || $segment === '..') { return null; } } return $path; } private function emptyCoverage() { return [ 'discovered' => 0, 'scanned' => 0, 'skipped' => 0, 'complete' => true, 'reasons' => [ 'unsafe_path' => 0, 'symlink' => 0, 'oversized' => 0, 'compression_ratio' => 0, 'entry_limit' => 0, 'nested_limit' => 0, 'unreadable' => 0, 'errors' => 0, ], ]; } private function mergeCoverage(array $left, array $right) { foreach (['discovered', 'scanned', 'skipped'] as $field) { $left[$field] += $right[$field]; } foreach ($right['reasons'] as $reason => $count) { $left['reasons'][$reason] += $count; } $left['complete'] = !empty($left['complete']) && !empty($right['complete']); return $left; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Scan; use AMWScan\Filesystem\Path; class Whitelist { private const CSV_VERSION_HEADER = '# amwscan-whitelist-v2'; private const MATCH_ENCODING_BASE64 = 'base64'; public static function isCsv($path) { return strtolower(pathinfo($path, PATHINFO_EXTENSION)) === 'csv'; } public static function read($path) { if (!is_file($path) || !is_readable($path)) { return []; } $contents = file_get_contents($path); return $contents === false ? [] : self::decode($contents, self::isCsv($path)); } public static function decode($contents, $isCsv) { if (!is_string($contents)) { return []; } if (!$isCsv) { $whitelist = json_decode($contents, true); return is_array($whitelist) ? self::validEntries($whitelist) : []; } $handle = fopen('php://temp', 'w+b'); if ($handle === false || fwrite($handle, $contents) === false) { if (is_resource($handle)) { fclose($handle); } return []; } rewind($handle); $whitelist = []; $isVersioned = false; $rowNumber = 0; while (($row = fgetcsv($handle, 0, ',', '"', '\\')) !== false) { if ($rowNumber++ === 0 && count($row) === 1 && trim($row[0]) === self::CSV_VERSION_HEADER) { $isVersioned = true; continue; } if (count($row) < 3) { continue; } $file = trim($row[0], " \t\n\r\0\x0B\""); $exploit = trim($row[1], " \t\n\r\0\x0B\""); $line = trim($row[2]); $lineNumber = $line === '' ? null : filter_var($line, FILTER_VALIDATE_INT); $item = [ 'file' => $file, 'exploit' => $exploit, 'line' => $lineNumber, ]; if (!$isVersioned && self::hasLeadingSeparator($item['file'])) { $item['file'] = self::legacyRelativePath($item['file']); } if (!self::isValidEntry($item)) { continue; } $key = md5($exploit . $file . $lineNumber); $whitelist[$key] = $item; } fclose($handle); return $whitelist; } public static function encode(array $whitelist, $isCsv) { $whitelist = self::validEntries($whitelist, true); if (!$isCsv) { return json_encode($whitelist, JSON_INVALID_UTF8_SUBSTITUTE); } $handle = fopen('php://temp', 'w+b'); if ($handle === false) { return false; } if (fwrite($handle, self::CSV_VERSION_HEADER . PHP_EOL) === false) { fclose($handle); return false; } foreach ($whitelist as $item) { if (!array_key_exists('line', $item)) { continue; } if (fputcsv($handle, [$item['file'], $item['exploit'], $item['line']], ',', '"', '\\') === false) { fclose($handle); return false; } } rewind($handle); $contents = stream_get_contents($handle); fclose($handle); return $contents; } public static function relativePath($filePath, $scanPath) { $filePath = self::resolvedPath($filePath); $scanPath = self::resolvedPath($scanPath); if ($filePath === '' || $scanPath === '') { return ''; } if (self::pathsEqual($filePath, $scanPath)) { return self::basename($filePath); } $prefix = rtrim($scanPath, '/') . '/'; if (self::pathStartsWith($filePath, $prefix)) { return ltrim(substr($filePath, strlen($prefix)), '/'); } return $filePath; } public static function matches($item, $filePath, array $pattern, $onlyPath, $scanPath = null) { if (!self::isValidEntry($item) || !isset($item['file'], $item['exploit']) || !isset($pattern['key']) || !self::matchesPath($item['file'], $filePath, $scanPath) || $pattern['key'] !== $item['exploit']) { return false; } if (!$onlyPath && (!array_key_exists('line', $item) || !array_key_exists('line', $pattern) || $pattern['line'] !== $item['line'])) { return false; } return !array_key_exists('match', $item) || (array_key_exists('match', $pattern) && is_string($pattern['match']) && self::matchesContent($item['match'], $pattern['match'])); } public static function countMatches(array $whitelist, $filePath, array $patterns, $onlyPath, $scanPath = null) { $matches = 0; foreach ($patterns as $pattern) { if (!is_array($pattern)) { continue; } foreach ($whitelist as $item) { if (self::matches($item, $filePath, $pattern, $onlyPath, $scanPath)) { $matches++; break; } } } return $matches; } public static function getWpAdminWhitelist(array $whitelist): array { $result = []; foreach ($whitelist as $item) { if (isset($item['kind']) && $item['kind'] === 'wp-admin' && self::isValidEntry($item)) { $result[] = [ 'target_id' => $item['target_id'], 'id' => (int)$item['id'], 'login' => (string)$item['login'], 'email' => (string)$item['email'], ]; } } return $result; } public static function wpAdminEntry($targetId, array $user): array { $entry = [ 'kind' => 'wp-admin', 'target_id' => $targetId, 'id' => $user['id'] ?? null, 'login' => $user['login'] ?? null, 'email' => $user['email'] ?? null, ]; if (!self::isValidEntry($entry)) { throw new \InvalidArgumentException('A scoped WordPress administrator identity is required.'); } $entry['id'] = (int)$entry['id']; return $entry; } private static function validEntries(array $whitelist, $forStorage = false) { $valid = []; foreach ($whitelist as $key => $item) { if (self::isLegacyRelativeEntry($key, $item)) { $item['file'] = self::legacyRelativePath($item['file']); } if (is_array($item) && array_key_exists('line', $item) && $item['line'] === '') { $item['line'] = null; } if (!self::isValidEntry($item)) { continue; } if (array_key_exists('match', $item)) { if ($forStorage) { unset($item['match_encoding']); if (@preg_match('//u', $item['match']) !== 1) { $item['match'] = base64_encode($item['match']); $item['match_encoding'] = self::MATCH_ENCODING_BASE64; } } elseif (array_key_exists('match_encoding', $item)) { $decoded = base64_decode($item['match'], true); if ($decoded === false) { continue; } $item['match'] = $decoded; unset($item['match_encoding']); } } $valid[$key] = $item; } return $valid; } private static function isValidEntry($item) { if (!is_array($item)) { return false; } $kind = $item['kind'] ?? 'file'; if ($kind === 'wp-admin') { return self::isValidWpAdminEntry($item); } if (!isset($item['file'], $item['exploit']) || !is_string($item['file']) || trim($item['file']) === '' || !(is_string($item['exploit']) || is_int($item['exploit'])) || (string)$item['exploit'] === '') { return false; } if (array_key_exists('line', $item) && $item['line'] !== null && (!is_int($item['line']) || $item['line'] < 1)) { return false; } if (array_key_exists('match_encoding', $item) && ($item['match_encoding'] !== self::MATCH_ENCODING_BASE64 || !array_key_exists('match', $item))) { return false; } return !array_key_exists('match', $item) || is_string($item['match']); } private static function isValidWpAdminEntry(array $item) { return isset($item['target_id'], $item['id'], $item['login'], $item['email']) && is_string($item['target_id']) && preg_match('/^[a-f0-9]{64}\z/', $item['target_id']) === 1 && (is_int($item['id']) || (is_string($item['id']) && ctype_digit($item['id']))) && filter_var($item['id'], FILTER_VALIDATE_INT, ['options' => ['min_range' => 1]]) !== false && is_string($item['login']) && trim($item['login']) !== '' && strlen($item['login']) <= 60 && is_string($item['email']) && trim($item['email']) !== '' && strlen($item['email']) <= 100; } private static function matchesPath($whitelistPath, $filePath, $scanPath) { $whitelistPath = self::normalizePath($whitelistPath); $filePath = self::resolvedPath($filePath); if ($whitelistPath === '' || $filePath === '') { return false; } if (self::pathsEqual($whitelistPath, $filePath)) { return true; } $relativePath = self::relativePath( $filePath, $scanPath === null ? dirname($filePath) : $scanPath ); return self::pathsEqual($whitelistPath, $relativePath); } private static function matchesContent($storedMatch, $currentMatch) { return $storedMatch === $currentMatch; } private static function isLegacyRelativeEntry($key, $item) { if (!is_string($key) || !is_array($item) || !isset($item['file'], $item['exploit']) || !is_string($item['file']) || !(is_string($item['exploit']) || is_int($item['exploit'])) || !self::hasLeadingSeparator($item['file'])) { return false; } $line = array_key_exists('line', $item) ? $item['line'] : ''; if (!is_string($line) && !is_int($line) && $line !== null) { return false; } return hash_equals(md5($item['exploit'] . $item['file'] . $line), $key); } private static function legacyRelativePath($path) { return preg_replace('/^[\\\\\/]+/', '', $path); } private static function hasLeadingSeparator($path) { return preg_match('/^[\\\\\/]/', $path) === 1; } private static function resolvedPath($path) { if (!is_string($path) || trim($path) === '') { return ''; } $resolved = realpath($path); return self::normalizePath($resolved === false ? $path : $resolved); } private static function normalizePath($path) { if (!is_string($path)) { return ''; } $path = Path::get($path); if (!is_string($path)) { return ''; } $path = str_replace(DIRECTORY_SEPARATOR, '/', $path); if ($path !== '/' && !preg_match('/^[A-Za-z]:\/$/', $path)) { $path = rtrim($path, '/'); } return $path; } private static function pathsEqual($left, $right) { if (DIRECTORY_SEPARATOR === '\\') { return strtolower($left) === strtolower($right); } return $left === $right; } private static function pathStartsWith($path, $prefix) { if (DIRECTORY_SEPARATOR === '\\') { $path = strtolower($path); $prefix = strtolower($prefix); } return strpos($path, $prefix) === 0; } private static function basename($path) { $position = strrpos($path, '/'); return $position === false ? $path : substr($path, $position + 1); } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Scan; use AMWScan\Filesystem\AtomicFile; class CheckpointStore { private const MAX_CHECKPOINT_BYTES = 33554432; private $path; public function __construct($path) { if (!is_string($path) || trim($path) === '') { throw new \InvalidArgumentException('Checkpoint path must be a non-empty string.'); } $directory = dirname($path); if (!is_dir($directory) && !mkdir($directory, 0700, true) && !is_dir($directory)) { throw new \RuntimeException(sprintf('Unable to create checkpoint directory "%s".', $directory)); } $this->path = $path; } public function save($manifestHash, $configurationHash, $nextIndex, array $report, array $progress = [], $completedChunks = null) { if (!is_string($manifestHash) || $manifestHash === '' || !is_string($configurationHash) || $configurationHash === '') { throw new \InvalidArgumentException('Checkpoint hashes must be non-empty strings.'); } if (!is_int($nextIndex) || $nextIndex < 0) { throw new \InvalidArgumentException('Checkpoint index must be a non-negative integer.'); } if ($progress !== [] && (!isset($progress['current'], $progress['total'], $progress['started_at']) || !is_int($progress['current']) || !is_int($progress['total']) || $progress['current'] < 0 || $progress['total'] < 1 || $progress['current'] > $progress['total'] || !is_string($progress['started_at']) || strtotime($progress['started_at']) === false)) { throw new \InvalidArgumentException('Checkpoint progress must contain valid current, total, and started_at values.'); } if ($completedChunks !== null && !$this->hasValidCompletedChunks($completedChunks, $nextIndex)) { throw new \InvalidArgumentException('Completed checkpoint chunks must be ordered, non-overlapping ranges with report deltas.'); } $checkpoint = [ 'schema' => $completedChunks === null ? 1 : 2, 'manifest_hash' => $manifestHash, 'configuration_hash' => $configurationHash, 'next_index' => $nextIndex, 'report' => $report, 'updated_at' => gmdate('c'), ]; if ($progress !== []) { $checkpoint['progress'] = $progress; } if ($completedChunks !== null) { $checkpoint['completed_chunks'] = array_values($completedChunks); } $json = json_encode($checkpoint, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_INVALID_UTF8_SUBSTITUTE); if (!is_string($json)) { throw new \RuntimeException('Unable to encode scan checkpoint.'); } AtomicFile::replaceContentsAtomically($this->path, $json, false); @chmod($this->path, 0600); } public function load($manifestHash, $configurationHash) { if (!is_file($this->path) || is_link($this->path)) { return null; } $size = filesize($this->path); if ($size === false || $size > self::MAX_CHECKPOINT_BYTES) { return null; } $contents = file_get_contents($this->path); $checkpoint = is_string($contents) ? json_decode($contents, true) : null; if (!is_array($checkpoint) || !isset($checkpoint['schema'], $checkpoint['manifest_hash'], $checkpoint['configuration_hash'], $checkpoint['next_index'], $checkpoint['report']) || !in_array($checkpoint['schema'], [1, 2], true) || !is_int($checkpoint['next_index']) || $checkpoint['next_index'] < 0 || !is_array($checkpoint['report']) || ($checkpoint['schema'] === 2 && (!array_key_exists('completed_chunks', $checkpoint) || !$this->hasValidCompletedChunks($checkpoint['completed_chunks'], $checkpoint['next_index']))) || !hash_equals((string)$checkpoint['manifest_hash'], (string)$manifestHash) || !hash_equals((string)$checkpoint['configuration_hash'], (string)$configurationHash)) { return null; } return $checkpoint; } private function hasValidCompletedChunks($chunks, $nextIndex) { if (!is_array($chunks) || !is_int($nextIndex)) { return false; } $previousEnd = $nextIndex; foreach ($chunks as $chunk) { if (!is_array($chunk) || !isset($chunk['start'], $chunk['end'], $chunk['delta']) || !is_int($chunk['start']) || !is_int($chunk['end']) || $chunk['start'] < $previousEnd || $chunk['end'] <= $chunk['start'] || !$this->hasValidWorkerDelta($chunk['delta'], $chunk['end'] - $chunk['start'])) { return false; } $previousEnd = $chunk['end']; } return true; } private function hasValidWorkerDelta($delta, $rangeLength) { if (!is_array($delta) || !isset($delta['scanned'], $delta['detected'], $delta['coverage']) || !is_int($delta['scanned']) || !is_int($delta['detected']) || $delta['scanned'] < 0 || $delta['detected'] < 0 || $delta['detected'] > $delta['scanned'] || !is_array($delta['coverage']) || !isset($delta['coverage']['scanned'], $delta['coverage']['skipped'], $delta['coverage']['errors'], $delta['coverage']['reasons']) || !is_int($delta['coverage']['scanned']) || !is_int($delta['coverage']['skipped']) || !is_int($delta['coverage']['errors']) || $delta['coverage']['scanned'] !== $delta['scanned'] || $delta['coverage']['skipped'] < 0 || $delta['coverage']['errors'] < 0 || $delta['scanned'] + $delta['coverage']['skipped'] + $delta['coverage']['errors'] !== $rangeLength || !is_array($delta['coverage']['reasons'])) { return false; } foreach (['findings', 'ignored', 'diagnostics', 'infectedFound', 'fileHashes'] as $field) { if (!isset($delta[$field]) || !is_array($delta[$field])) { return false; } } return true; } public function clear() { if (is_file($this->path) && !@unlink($this->path)) { throw new \RuntimeException('Unable to remove scan checkpoint.'); } } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Scan; use AMWScan\AI\FindingReviewer; use AMWScan\Console\Argv; use AMWScan\Console\CLI; use AMWScan\Definitions\DefinitionBundleStore; use AMWScan\Definitions\LocalDefinitionSource; use AMWScan\Definitions\RuleData; use AMWScan\Detection\CodeMatch; use AMWScan\Detection\Deobfuscator; use AMWScan\Detection\Exploits; use AMWScan\Detection\Functions; use AMWScan\Detection\PhpCodeContext; use AMWScan\Detection\Signatures; use AMWScan\Filesystem\AtomicFile; use AMWScan\Filesystem\Cache; use AMWScan\Filesystem\Path; use AMWScan\Findings\Finding; use AMWScan\Findings\FindingStore; use AMWScan\Platform\Platform; use AMWScan\Platform\WordPress\Database; use AMWScan\Remediation\Actions; use AMWScan\Remediation\Diff; use AMWScan\Remediation\Editor; use AMWScan\Remediation\FileRemediator; use AMWScan\Remediation\PhpLinter; use AMWScan\Remote\FtpMirror; use AMWScan\Reporting\Report; use AMWScan\Reputation\DomainExtractor; use AMWScan\Reputation\DomainScanner; use AMWScan\Reputation\MaltrailDefinitionStore; /** * Class Application. */ class Scanner { public const SCAN_CACHE_VERSION = 8; public const SCAN_CACHE_TTL = 604800; private const LITE_SIGNATURE_EXCLUSIONS = ['78549b63', 'f2363f4b', '2638466f', '91535293']; private const GENERIC_SIGNATURE_KEYWORDS = ['backdoor', 'exploit']; private const OVERSIZED_SIGNATURE_SAMPLE_BYTES = 32768; /** * Minimum number of files before report-only scans are split across workers. */ private const PARALLEL_MIN_FILES = 100; /** * Maximum worker count used when no explicit jobs setting is provided. */ private const PARALLEL_MAX_DEFAULT_JOBS = 8; /** * Unix niceness used for worker processes by default (19 = lowest priority). */ private const WORKER_DEFAULT_PRIORITY = 19; /** * Seconds between parallel scan progress/ETA updates. */ private const PARALLEL_PROGRESS_INTERVAL = 5; /** * Checkpoint writes are deliberately coalesced to avoid serializing a * growing report after every file. */ private const CHECKPOINT_FILE_INTERVAL = 100; private const CHECKPOINT_TIME_INTERVAL = 2.0; private const HEARTBEAT_TIME_INTERVAL = 5.0; private static $lastCheckpointIndex; private static $lastCheckpointWrite = 0.0; private static $lastHeartbeatWrite = 0.0; private static $checkpointCompletedChunks; /** * App name. * * @var string */ public static $name = 'AMWScan'; /** * App full name. * * @var string */ public static $fullname = 'PHP Antimalware Scanner'; /** * App description. * * @var string */ public static $description = 'A tool to scan PHP files and analyze your project to find any malicious code inside it.'; /** * App author. * * @var string */ public static $author = 'Marco Cesarato'; /** * Version. * * @var string */ public static $version = '0.21.15'; /** * Repo url. * * @var string */ public static $repoUrl = 'https://github.com/marcocesarato/PHP-Antimalware-Scanner'; /** * Version url. * * @var string */ public static $latestVersionUrl = 'https://raw.githubusercontent.com/marcocesarato/PHP-Antimalware-Scanner/master/dist/version'; /** * Latest release url. * * @var string */ protected static $latestReleaseUrl = 'https://raw.githubusercontent.com/marcocesarato/PHP-Antimalware-Scanner/master/dist/scanner'; /** * @var string */ public static $dateFormat = 'Y-m-d'; /** * Root path. * * @var string */ public static $root = './'; /** * Quarantine path. * * @var string */ public static $pathQuarantine = '/scanner-quarantine/'; /** * Backup path. * * @var string */ public static $pathBackups = '/scanner-backups/'; /** * Deobfuscate path. * * @var string */ public static $pathDeobfuscate = '/deobfuscated/'; /** * Logs Path. * * @var string */ public static $pathLogs = '/scanner.log'; /** * Infected logs path. *s. * * @var string */ public static $pathReport = '/scanner-report_{DIRNAME}_{DATE}'; /** * Whitelist path. * * @var string */ public static $pathWhitelist = '/scanner-whitelist.json'; /** * Optional durable canonical finding store. * * @var string|null */ public static $pathFindings; /** * Optional resumable scan checkpoint. * * @var string|null */ public static $pathCheckpoint; /** * Active local Maltrail definition store. * * @var MaltrailDefinitionStore|null */ public static $maltrailDefinitions; /** * Active AMWScan definition bundle metadata. * * @var array|null */ public static $definitionBundleMetadata; /** * Programmatic API key used by embedded integrations such as WordPress. * * @var string|null */ protected static $aiApiKey; /** * Path to scan. * * @var string */ public static $pathScan = './'; /** * Max filesize. * * @var int */ public static $maxFilesize = -1; /** * File extensions to scan. * * @var array */ public static $extensions = [ 'htaccess', 'php', 'php3', 'ph3', 'php4', 'ph4', 'php5', 'ph5', 'php7', 'ph7', 'php8', 'ph8', 'phtm', 'phtml', 'ico', 'css', 'ccss', 'js', ]; /** * Default no to scan all files. */ public static $scanAll = false; /** * Arguments. * * @var Argv */ public static $argv = []; /** * Whitelist. * * @var array */ public static $whitelist = []; /** * Functions. * * @var array */ public static $functions = []; /** * Functions encoded. * * @var array */ public static $functionsEncoded = []; /** * Functions encoded values. * * @var array */ protected static $functionsEncodedValues = []; /** * Exploits. * * @var array */ public static $exploits = []; /** * Settings. * * @var array */ private static $pathScanControl; /** * @var string|null */ private static $pathScanHeartbeat; public static $settings = [ 'scan-exploits' => true, 'scan-functions' => true, 'scan-signatures' => true, 'scan-domains' => true, 'scan-wordpress-db' => false, 'wordpress-admin-threshold' => Database::MAX_NORMAL_ADMINISTRATOR_THRESHOLD, 'check-updates' => false, 'ai-provider' => 'disabled', ]; /** * Report. * * @var array */ protected static $report = [ 'scanned' => 0, 'detected' => 0, 'verifiedByChecksum' => 0, 'removed' => [], 'ignored' => [], 'edited' => [], 'quarantine' => [], 'whitelist' => [], 'infectedFound' => [], 'fileHashes' => [], 'findings' => [], 'coverage' => [], ]; /** * Report file format. * * @var string */ protected static $reportFormat = 'html'; /** * Ignore paths. * * @var array */ public static $ignorePaths = []; /** * Filter paths. * * @var array */ public static $filterPaths = []; /** * Expanded roots selected by wildcard or multiple path arguments. * * @var array */ protected static $scanPathFilters = []; /** * Prompt. * * @var string */ public static $prompt; /** * Interrupt. * * @var bool */ public $interrupt = false; /** * @var string */ public $lastError; /** * Temporary read-only FTP mirrors used by the current run. * * @var FtpMirror[] */ protected $ftpMirrors = []; /** * Local FTP mirror roots mapped to sanitized remote source labels. * * @var array */ protected $ftpSourceMap = []; protected static $inited = false; /** * Fingerprint of the active detection configuration. * * @var string|null */ protected static $scanCacheFingerprint; /** * Non-malware findings produced while scanning the current file. * * @var array */ protected $supplementalFindings = []; /** * @var Platform */ protected $platforms; /** * Application constructor. */ public function __construct(?callable $wordpressDatabaseFactory = null) { $this->platforms = new Platform($wordpressDatabaseFactory); if (!self::isInitialized()) { if (function_exists('gc_enable') && (function_exists('gc_enable') && !gc_enabled())) { gc_enable(); } if (self::$root === './') { self::$root = Path::getCurrentDir(); } if (self::$pathScan === './') { self::$pathScan = Path::getCurrentDir(); } self::$pathQuarantine = Path::get(self::$root . self::$pathQuarantine); self::$pathLogs = Path::get(self::$root . self::$pathLogs); self::$pathWhitelist = Path::get(self::$root . self::$pathWhitelist); self::$pathReport = Path::get(self::$root . self::$pathReport); self::$pathBackups = Path::get(self::$root . self::$pathBackups); self::$pathDeobfuscate = Path::get(self::$root . self::$pathDeobfuscate); self::$inited = true; } } /** * Initialize. */ private function init() { // Load whitelist $whitelist = is_file(self::$pathWhitelist) ? Whitelist::read(self::$pathWhitelist) : self::$whitelist; if (strtolower(basename(self::$pathWhitelist)) === 'scanner-whitelist.json') { foreach (['scanner-whitelist.csv', 'scanner_whitelist.csv'] as $legacyFile) { $legacyWhitelist = dirname(self::$pathWhitelist) . DIRECTORY_SEPARATOR . $legacyFile; $whitelist += Whitelist::read($legacyWhitelist); } } self::$whitelist = $whitelist; } /** * Run application. * * @param null $args * * @return bool|object */ public function run($args = []) { $this->interrupt = false; self::resetReport(); $previousErrorReporting = error_reporting(); $previousDisplayErrors = ini_get('display_errors'); try { // Initialize arguments $this->arguments($args); self::$lastHeartbeatWrite = 0.0; self::touchScanHeartbeat(true); // Print header CLI::header(); self::setSignatureIndexReportMetadata(); // Initialize $this->init(); // Initialize modes $this->modes(); self::$scanCacheFingerprint = null; // Start scanning CLI::displayLine('Start scanning...'); CLI::writeLine('Scan date: ' . date(self::$dateFormat . ' H:i:s')); CLI::writeLine('Scanning ' . self::$pathScan, 2); // Mapping files if (self::isVerifierEnabled()) { CLI::writeLine('Mapping and retrieving checksums, please wait...', 2); } else { CLI::writeLine('Mapping, please wait...', 2); } $iterator = $this->mapping(); // Counting files $filesCount = iterator_count($iterator); CLI::writeLine('Found ' . $filesCount . ' files to check', 2); CLI::writeLine('Checking files...', 2); if ($this->interrupt) { return false; } // Scan all files $this->scan($iterator); $this->rewriteFtpReportPaths(); $fileScanComplete = !empty(self::$report['coverage']['complete']); if ($fileScanComplete) { $this->runSupplementalAnalyses(); } $selections = !empty(self::$scanPathFilters) ? self::$scanPathFilters : [self::$pathScan]; self::$report = $this->platforms->runEnabledPhases( self::$report, $selections, self::$settings, $fileScanComplete, static function () { self::touchScanHeartbeat(true); } ); if (!empty(self::$report['coverage']['complete'])) { $this->reviewFindingsWithAi(); $this->reconcileFindings(); } // Scan finished CLI::writeBreak(2); CLI::write('Scan finished!', 'green'); CLI::writeBreak(3); // Print summary $this->summary(); return self::getReport(); } catch (\Exception $e) { $this->interrupt = true; $this->setLastError($e->getMessage()); CLI::writeBreak(); CLI::writeLine($e->getMessage(), 1, 'red'); return false; } finally { self::clearScanHeartbeat(); foreach ($this->ftpMirrors as $ftpMirror) { $ftpMirror->cleanup(); } $this->ftpMirrors = []; $this->ftpSourceMap = []; error_reporting($previousErrorReporting); ini_set('display_errors', $previousDisplayErrors); } } /** * Initialize application arguments. * * @param array $args */ private function arguments($args = []) { $isCLI = self::isCli(); self::$argv = new Argv(self::getLowerName(), self::getDescription()); // Arguments self::$argv->addArgument('path', ['var_arg' => true, 'default' => Path::getCurrentDir(), 'help' => 'Define file or directory paths to scan. Wildcards are supported']); // Flags self::$argv->addFlag('lite', ['alias' => '-l', 'default' => false, 'help' => 'Running on lite mode help to have less false positive on WordPress and others platforms enabling exploits mode and removing some common exploit pattern']); self::$argv->addFlag('help', ['alias' => ['-h', '-?'], 'default' => false, 'help' => 'Check only functions and not the exploits']); self::$argv->addFlag('log', ['default' => false, 'has_value' => true, 'value_name' => 'path', 'help' => 'Write a log file on the specified file path']); self::$argv->addFlag('backup', ['alias' => '-b', 'default' => false, 'help' => 'Make a backup of every touched files']); self::$argv->addFlag('offset', ['default' => null, 'has_value' => true, 'help' => 'Set file mapping offset']); self::$argv->addFlag('limit', ['default' => null, 'has_value' => true, 'help' => 'Set file mapping limit']); self::$argv->addFlag('report', ['default' => false, 'help' => 'Write a report without changing the scan mode']); self::$argv->addFlag('report-only', ['alias' => '-r', 'default' => false, 'help' => "Disable interactive actions (like --auto-skip) and write a report\nwith all malware paths found"]); self::$argv->addFlag('report-format', ['default' => false, 'has_value' => true, 'value_name' => 'format', 'help' => 'Report format (html|txt|json|sarif)']); self::$argv->addFlag('version', ['alias' => '-v', 'default' => false, 'help' => 'Get version number']); self::$argv->addFlag('update', ['alias' => '-u', 'default' => false, 'help' => 'Update to last version']); self::$argv->addFlag('only-signatures', ['alias' => '-s', 'default' => false, 'help' => "Check only signatures and not the functions or exploits.\nThis is recommended for WordPress or others platforms"]); self::$argv->addFlag('only-exploits', ['alias' => '-e', 'default' => false, 'help' => 'Check only exploits and not the functions']); self::$argv->addFlag('only-functions', ['alias' => '-f', 'default' => false, 'help' => 'Check only functions and not the exploits']); self::$argv->addFlag('defs', ['default' => false, 'help' => 'Get default definitions exploit and functions list']); self::$argv->addFlag('defs-exploits', ['default' => false, 'help' => 'Get default definitions exploits list']); self::$argv->addFlag('defs-functions', ['default' => false, 'help' => 'Get default definitions functions lists']); self::$argv->addFlag('defs-functions-encoded', ['default' => false, 'help' => 'Get default definitions functions encoded lists']); self::$argv->addFlag('exploits', ['default' => false, 'has_value' => true, 'help' => 'Filter exploits']); self::$argv->addFlag('ignore-exploits', ['default' => false, 'has_value' => true, 'help' => 'Ignore exploit/s, for multiple value separate with comma.']); self::$argv->addFlag('functions', ['default' => false, 'has_value' => true, 'help' => 'Define functions to search']); self::$argv->addFlag('whitelist-only-path', ['default' => false, 'help' => 'Ignore line numbers when matching whitelist entries']); self::$argv->addFlag('max-filesize', ['default' => -1, 'has_value' => true, 'value_name' => 'filesize', 'help' => 'Set max filesize to scan']); self::$argv->addFlag('debug', ['default' => false, 'help' => 'Show all PHP errors and warnings (sets error_reporting(E_ALL), display_errors=1)']); self::$argv->addFlag('silent', ['default' => !$isCLI, 'help' => 'No output and prompt']); self::$argv->addFlag('ignore-paths', ['alias' => '--ignore-path', 'default' => null, 'has_value' => true, 'value_name' => 'paths', 'help' => "Ignore path/s, for multiple value separate with comma.\nWildcards are enabled ex. /path/*/cache or /path/*.log"]); self::$argv->addFlag('filter-paths', ['alias' => '--filter-path', 'default' => null, 'has_value' => true, 'value_name' => 'paths', 'help' => "Filter path/s, for multiple value separate with comma.\nWildcards are enabled ex. /path/*/htdocs or /path/*.php"]); self::$argv->addFlag('ftp-user', ['default' => null, 'has_value' => true, 'value_name' => 'username', 'help' => 'FTP username (or use AMWSCAN_FTP_USER)']); self::$argv->addFlag('auto-clean', ['default' => false, 'help' => 'Auto clean code (without confirmation, use with caution)']); self::$argv->addFlag('auto-clean-line', ['default' => false, 'help' => 'Auto clean line code (without confirmation, use with caution)']); self::$argv->addFlag('auto-delete', ['default' => false, 'help' => 'Auto delete infected (without confirmation, use with caution)']); self::$argv->addFlag('auto-quarantine', ['default' => false, 'help' => 'Auto quarantine']); self::$argv->addFlag('auto-skip', ['default' => false, 'help' => 'Auto skip']); self::$argv->addFlag('auto-whitelist', ['default' => false, 'help' => 'Auto whitelist (if you sure that source isn\'t compromised)']); self::$argv->addFlag('auto-prompt', ['default' => null, 'has_value' => true, 'value_name' => 'prompt', 'help' => "Set auto prompt command .\nex. --auto-prompt=\"delete\" or --auto-prompt=\"1\" (alias of auto-delete)"]); self::$argv->addFlag('path-whitelist', ['default' => self::$pathWhitelist, 'has_value' => true, 'value_name' => 'path', 'help' => 'Set whitelist file']); self::$argv->addFlag('path-deobfuscate', ['default' => self::$pathDeobfuscate, 'has_value' => true, 'value_name' => 'path', 'help' => "Set debofuscated files path directory.\nIs recommended put files outside the public document path"]); self::$argv->addFlag('path-backups', ['default' => self::$pathBackups, 'has_value' => true, 'value_name' => 'path', 'help' => "Set backups path directory.\nIs recommended put files outside the public document path"]); self::$argv->addFlag('path-quarantine', ['default' => self::$pathQuarantine, 'has_value' => true, 'value_name' => 'path', 'help' => "Set quarantine path directory.\nIs recommended put files outside the public document path"]); self::$argv->addFlag('path-logs', ['default' => self::$pathLogs, 'has_value' => true, 'value_name' => 'path', 'help' => 'Set quarantine log file']); self::$argv->addFlag('path-report', ['default' => self::$pathReport, 'has_value' => true, 'value_name' => 'path', 'help' => "Set report log file path and name.\nNote that name will be appended with .log or .html extension."]); self::$argv->addFlag('path-definitions', ['default' => MaltrailDefinitionStore::getDefaultPath(), 'has_value' => true, 'value_name' => 'path', 'help' => 'Set the private definition cache directory']); self::$argv->addFlag('path-local-rules', ['default' => LocalDefinitionSource::getDefaultPath(), 'has_value' => true, 'value_name' => 'path', 'help' => 'Set the administrator-managed local rule directory']); self::$argv->addFlag('definitions-update-url', ['default' => null, 'has_value' => true, 'value_name' => 'url', 'help' => 'Set the HTTPS AMWDB release metadata URL']); self::$argv->addFlag('disable-colors', ['alias' => ['--no-colors', '--no-color'], 'default' => false, 'help' => 'Disable CLI colors']); self::$argv->addFlag('disable-cache', ['alias' => '--no-cache', 'default' => false, 'help' => 'Disable Cache']); self::$argv->addFlag('disable-report', ['alias' => '--no-report', 'default' => !$isCLI, 'help' => 'Disable report generation']); self::$argv->addFlag('disable-checksum', ['alias' => ['--no-checksum', '--no-verify'], 'default' => false, 'help' => 'Disable checksum verifying for platforms/frameworks']); self::$argv->addFlag('disable-definitions-update', ['default' => false, 'help' => 'Use cached or embedded definitions without checking for updates']); self::$argv->addFlag('disable-domain-analysis', ['alias' => '--no-domain-analysis', 'default' => false, 'help' => 'Disable dangerous-domain analysis, including the default scan of JavaScript files']); self::$argv->addFlag('domain-analysis-scope', ['default' => 'all', 'has_value' => true, 'value_name' => 'scope', 'help' => 'Dangerous-domain analysis scope: scripts or all (default: all)']); self::$argv->addFlag('scan-all', ['alias' => ['--all'], 'default' => false, 'help' => 'Check all files, regardless of extension']); self::$argv->addFlag('scan-archives', ['default' => false, 'help' => 'Scan ZIP archive entries with strict resource limits']); self::$argv->addFlag('check-updates', ['default' => false, 'help' => 'Check available platform component versions online (WordPress.org); disabled by default']); self::$argv->addFlag('scan-wordpress-db', ['default' => false, 'help' => 'Read-only scan of WordPress database triggers, administrator accounts, and orphaned posts']); self::$argv->addFlag('wordpress-admin-threshold', ['default' => Database::MAX_NORMAL_ADMINISTRATOR_THRESHOLD, 'has_value' => true, 'value_name' => 'count', 'help' => 'Warn when the WordPress administrator count exceeds this positive integer (default: 1; requires --scan-wordpress-db)']); self::$argv->addFlag('findings-store', ['default' => null, 'has_value' => true, 'value_name' => 'path', 'help' => 'Persist canonical finding lifecycle state to a private JSON file']); self::$argv->addFlag('checkpoint', ['default' => null, 'has_value' => true, 'value_name' => 'path', 'help' => 'Persist resumable scan progress to a private JSON file']); self::$argv->addFlag('scan-control', ['default' => null, 'has_value' => true, 'value_name' => 'path', 'help' => 'Read cooperative pause or cancel requests from a private control file']); self::$argv->addFlag('scan-heartbeat', ['default' => null, 'has_value' => true, 'value_name' => 'path', 'help' => 'Update a private heartbeat file while a scan is active']); self::$argv->addFlag('resume', ['default' => false, 'help' => 'Resume a matching scan checkpoint']); self::$argv->addFlag('jobs', ['alias' => ['-j'], 'default' => 'auto', 'has_value' => true, 'value_name' => 'count', 'help' => 'Number of parallel worker processes used to scan files during report-only scans (default: detected CPU cores, capped at 8; explicit 0 or auto = all detected CPU cores; 1 disables parallelism). Requires the pcntl extension. The AMWSCAN_JOBS environment variable is used when the flag is omitted']); self::$argv->addFlag('ai-provider', ['default' => 'disabled', 'has_value' => true, 'value_name' => 'provider', 'help' => 'Advisory finding review provider (openai|anthropic|gemini|claude-code-cli|codex-cli|copilot-cli|opencode-cli)']); self::$argv->addFlag('ai-model', ['default' => null, 'has_value' => true, 'value_name' => 'model', 'help' => 'Override the AI provider model']); self::$argv->addFlag('ai-context-lines', ['default' => 5, 'has_value' => true, 'value_name' => 'lines', 'help' => 'Code lines included above and below a detected line (0-20)']); self::$argv->addFlag('ai-max-findings', ['default' => 20, 'has_value' => true, 'value_name' => 'count', 'help' => 'Maximum findings sent for AI review (1-100)']); self::$argv->addFlag('ai-timeout', ['default' => 30, 'has_value' => true, 'value_name' => 'seconds', 'help' => 'Timeout for each AI review (5-300 seconds)']); self::$argv->addFlag('ai-executable', ['default' => null, 'has_value' => true, 'value_name' => 'path', 'help' => 'Executable name or path for a local AI CLI provider']); // self::$argv->addFlag('deobfuscate', ['default' => false, 'help' => 'Deobfuscate directory']); self::$argv->parse($args); // Version if (isset(self::$argv['version']) && self::$argv['version']) { fwrite(STDOUT, self::getVersion() . PHP_EOL); $this->interrupt(); } // Help if (isset(self::$argv['help']) && self::$argv['help']) { CLI::helper(); $this->interrupt(); } $this->configureAiReview($isCLI); // Path Whitelist (must be before configureSecurityFeatures which reads it) if (isset(self::$argv['path-whitelist']) && !empty(self::$argv['path-whitelist'])) { self::setPathWhitelist(self::$argv['path-whitelist']); } $this->configureSecurityFeatures(); self::configureParallelJobs(); // Debug if (isset(self::$argv['debug']) && self::$argv['debug']) { error_reporting(E_ALL); ini_set('display_errors', 1); CLI::writeLine('Debug mode enabled: displaying all errors and warnings', 1, 'yellow'); } // List exploits if (isset(self::$argv['defs']) && self::$argv['defs']) { CLI::helplist(); $this->interrupt(); } // List exploits if (isset(self::$argv['defs-exploits']) && self::$argv['defs-exploits']) { CLI::helplist('exploits'); } // List functions if (isset(self::$argv['defs-functions']) && self::$argv['defs-functions']) { CLI::helplist('functions'); } // List functions encoded if (isset(self::$argv['defs-functions-encoded']) && self::$argv['defs-functions-encoded']) { CLI::helplist('functions-encoded'); } // Update if (isset(self::$argv['update']) && self::$argv['update']) { $this->update(); $this->interrupt(); } // Silent if (isset(self::$argv['silent']) && self::$argv['silent']) { self::setSilentMode(); } // Backups if (isset(self::$argv['backup']) && self::$argv['backup']) { self::enableBackups(); } // Colors if (self::$argv['disable-colors']) { self::setColors(false); } elseif (function_exists('ncurses_has_colors')) { self::setColors(ncurses_has_colors()); } // Cache if (isset(self::$argv['disable-cache']) && self::$argv['disable-cache']) { self::disableCache(); } // Verifier if (isset(self::$argv['disable-checksum']) && self::$argv['disable-checksum']) { self::disableChecksum(); } // Max filesize if (isset(self::$argv['max-filesize']) && is_numeric(self::$argv['max-filesize'])) { self::setMaxFilesize(self::$argv['max-filesize']); } // Write logs if (isset(self::$argv['log']) && !empty(self::$argv['log'])) { self::enableLogs(); if (is_string(self::$argv['log'])) { self::setPathLogs(self::$argv['log']); } } // Offset self::setOffset(0); if (isset(self::$argv['offset']) && is_numeric(self::$argv['offset'])) { self::setOffset((int)self::$argv['offset']); } // Limit self::setLimit(0); if (isset(self::$argv['limit']) && is_numeric(self::$argv['limit'])) { self::setLimit((int)self::$argv['limit']); } // Path quarantine if (isset(self::$argv['path-quarantine']) && !empty(self::$argv['path-quarantine'])) { self::setPathQuarantine(self::$argv['path-quarantine']); } // Path backups if (isset(self::$argv['path-backups']) && !empty(self::$argv['path-backups'])) { self::setPathBackups(self::$argv['path-backups']); } // Path deobfuscate if (isset(self::$argv['path-deobfuscate']) && !empty(self::$argv['path-deobfuscate'])) { self::setPathDeobfuscate(self::$argv['path-deobfuscate']); } // Report mode if (self::$argv->wasProvided('report-only')) { self::setReportMode((bool)self::$argv['report-only']); } elseif (!array_key_exists('report-mode', self::$settings)) { self::setReportMode(false); } // Report if (self::$argv->wasProvided('disable-report')) { self::setReport(!self::$argv['disable-report']); } elseif ((self::$argv->wasProvided('report') && self::$argv['report']) || (self::$argv->wasProvided('report-only') && self::$argv['report-only'])) { self::enableReport(); } elseif (!array_key_exists('report', self::$settings)) { self::disableReport(); } // Deobfuscate mode if (isset(self::$argv['deobfuscate']) && self::$argv['deobfuscate']) { self::enableDeobfuscateMode(); self::disableReport(); } // Path report if (isset(self::$argv['path-report']) && !empty(self::$argv['path-report'])) { self::setPathReport(self::$argv['path-report']); } // Report format if (isset(self::$argv['report-format']) && !empty(self::$argv['report-format'])) { self::setReportFormat(self::$argv['report-format']); } // Path logs if (isset(self::$argv['path-logs']) && !empty(self::$argv['path-logs'])) { self::setPathLogs(self::$argv['path-logs']); } // Ignore paths if (isset(self::$argv['ignore-paths']) && !empty(self::$argv['ignore-paths'])) { $paths = explode(',', self::$argv['ignore-paths']); $ignorePaths = []; foreach ($paths as $path) { $ignorePaths[] = Path::get($path); } self::setIgnorePaths($ignorePaths); } // Filter paths if (isset(self::$argv['filter-paths']) && !empty(self::$argv['filter-paths'])) { $paths = explode(',', self::$argv['filter-paths']); $filterPaths = []; foreach ($paths as $path) { $filterPaths[] = Path::get($path); } self::setFilterPaths($filterPaths); } // Check on whitelist only file path and not line number if (isset(self::$argv['whitelist-only-path']) && self::$argv['whitelist-only-path']) { self::setOnlyPathWhitelistMode(); } // Check Filter exploits if (isset(self::$argv['exploits']) && self::$argv['exploits'] && is_string(self::$argv['exploits'])) { $exploits = []; $filtered = str_replace(["\n", "\r", "\t", ' '], '', self::$argv['exploits']); $filtered = @explode(',', $filtered); $filtered = array_map('trim', $filtered); if (!empty($filtered) && count($filtered) > 0) { foreach (Exploits::getAll() as $key => $value) { if (in_array($key, $filtered, true)) { $exploits[$key] = $value; } } if (!empty($exploits) && count($exploits) > 0) { CLI::writeLine('Exploit to search: ' . implode(', ', array_keys($exploits))); } else { $exploits = []; } } self::setExploits($exploits); } // Ignore exploits if (isset(self::$argv['ignore-exploits']) && !empty(self::$argv['ignore-exploits'])) { $exploits = []; $ignored = str_replace(["\n", "\r", "\t", ' '], '', self::$argv['ignore-exploits']); $ignored = @explode(',', $ignored); $ignored = array_map('trim', $ignored); if (!empty($ignored) && count($ignored) > 0) { foreach (Exploits::getAll() as $key => $value) { if (!in_array($key, $ignored, true)) { $exploits[$key] = $value; } } if (!empty($exploits) && count($exploits) > 0) { CLI::writeLine('Exploit to search: ' . implode(', ', array_keys($exploits))); } else { $exploits = []; } } self::setExploits($exploits); } // Check functions to search if (isset(self::$argv['functions']) && self::$argv['functions'] && is_string(self::$argv['functions'])) { $functions = str_replace(["\n", "\r", "\t", ' '], '', self::$argv['functions']); $functions = @explode(',', $functions); $functions = array_map('trim', $functions); if (!empty($functions) && count($functions) > 0) { CLI::writeLine('Functions to search: ' . implode(', ', $functions)); } else { $functions = []; } self::setFunctions($functions); } // Check if exploit mode is enabled if (isset(self::$argv['only-exploits']) && self::$argv['only-exploits']) { self::setOnlyExploitsMode(); } // Check if functions mode is enabled if (isset(self::$argv['only-functions']) && self::$argv['only-functions']) { self::setOnlyFunctionsMode(); } // Check if only signatures mode is enabled if (isset(self::$argv['only-signatures'])) { self::setOnlySignaturesMode(); } // Check if lite scan is enabled if (isset(self::$argv['lite']) && self::$argv['lite']) { self::enableLiteMode(); } // Prompt if (isset(self::$argv['auto-clean']) && self::$argv['auto-clean']) { self::setAutoClean(); } if (isset(self::$argv['auto-clean-line']) && self::$argv['auto-clean-line']) { self::setAutoCleanLine(); } if (isset(self::$argv['auto-delete']) && self::$argv['auto-delete']) { self::setAutoDelete(); } if (isset(self::$argv['auto-quarantine']) && self::$argv['auto-quarantine']) { self::setAutoQuarantine(); } if (isset(self::$argv['auto-whitelist']) && self::$argv['auto-whitelist']) { self::setAutoWhitelist(); } if (isset(self::$argv['auto-skip']) && self::$argv['auto-skip']) { self::setAutoSkip(); } if (isset(self::$argv['auto-prompt']) && !empty(self::$argv['auto-prompt'])) { if (in_array(strtolower((string)self::$argv['auto-prompt']), ['5', 'vim', '6', 'nano'], true)) { throw new \InvalidArgumentException('Vim and nano are interactive actions and cannot be used with --auto-prompt.'); } self::setPrompt(self::$argv['auto-prompt']); } // Check if logs and scan at the same time if (self::isLogEnabled() && self::isReportMode()) { self::disableLogs(); } // Check for path or functions as first argument $pathArguments = self::$argv['path']; $pathArguments = is_array($pathArguments) ? $pathArguments : [$pathArguments]; $ftpSources = array_values(array_filter($pathArguments, [self::class, 'isFtpSource'])); if (count($ftpSources) > 1 || (!empty($ftpSources) && count($pathArguments) > 1)) { throw new \InvalidArgumentException('FTP scanning accepts exactly one remote source per run'); } if (!empty($ftpSources) && !empty(self::$settings['scan-wordpress-db'])) { throw new \InvalidArgumentException('WordPress database scanning is unavailable for FTP sources'); } $localPathArguments = []; $hasFtpSource = false; foreach ($pathArguments as $pathArgument) { if (!self::isFtpSource($pathArgument)) { $localPathArguments[] = $pathArgument; continue; } $host = parse_url($pathArgument, PHP_URL_HOST); CLI::writeLine('Mirroring read-only FTP source ' . $host . ', please wait...', 1, 'grey'); $ftpMirror = new FtpMirror(); $localPathArguments[] = $ftpMirror->mirror( $pathArgument, self::$argv['ftp-user'], getenv('AMWSCAN_FTP_PASSWORD') ?: null ); $this->ftpMirrors[] = $ftpMirror; $this->ftpSourceMap[end($localPathArguments)] = self::sanitizeFtpSource($pathArgument); $hasFtpSource = true; } if ($hasFtpSource) { self::enableReportMode(); self::setAutoSkip(); self::disableCache(); self::$pathCheckpoint = null; self::$settings['resume'] = false; } $scanPaths = self::expandScanPaths($localPathArguments); if (empty($scanPaths)) { throw new \InvalidArgumentException('No files or directories matched the requested scan paths'); } self::setExpandedScanPaths($scanPaths); // Should we scan each and any file? if (isset(self::$argv['scan-all']) && self::$argv['scan-all']) { self::setScanAll(true); } } /** * Init application modes. */ private function modes() { if (self::isOnlyFunctionsMode() && self::isOnlyExploitsMode() && self::isOnlySignaturesMode()) { $error = 'Can\'t be set flags --only-signatures, --only-functions and --only-exploits together!'; CLI::writeLine($error, 2); $this->interrupt(); $this->setLastError($error); } if (self::isOnlyFunctionsMode() && self::isOnlySignaturesMode()) { $error = 'Can\'t be set both flags --only-signatures and --only-functions together!'; CLI::writeLine($error, 2); $this->interrupt(); $this->setLastError($error); } if (self::isOnlySignaturesMode() && self::isOnlyExploitsMode()) { $error = 'Can\'t be set both flags --only-signatures and --only-exploits together!'; CLI::writeLine($error, 2); $this->interrupt(); $this->setLastError($error); } if (self::isOnlyFunctionsMode() && self::isOnlyExploitsMode()) { $error = 'Can\'t be set both flags --only-functions and --only-exploits together!'; CLI::writeLine($error, 2); $this->interrupt(); $this->setLastError($error); } // Malware Definitions if (self::isOnlyFunctionsMode() || (!self::isOnlyExploitsMode() && empty(self::$functions))) { // Functions to search self::setFunctions(Functions::getDefault()); } elseif (!self::isOnlyExploitsMode() && !self::isLiteMode() && empty(self::$functions)) { CLI::writeLine('No functions to search'); } if (self::$argv['max-filesize'] > 0) { CLI::writeLine('Max filesize: ' . self::getMaxFilesize() . ' bytes', 2); } // Exploits to search if (!self::isOnlyFunctionsMode() && empty(self::$exploits)) { self::setExploits(Exploits::getAll()); } if (self::isLiteMode()) { CLI::writeLine('Agile mode enabled'); } if (self::isReportMode()) { CLI::writeLine('Report scan mode enabled'); } if (self::isOnlyFunctionsMode()) { CLI::writeLine('Only function mode enabled'); self::setExploits([]); } if (self::isOnlyExploitsMode() && !self::isLiteMode()) { CLI::writeLine('Only exploit mode enabled'); self::setFunctions([]); self::setFunctionsEncoded(Functions::getDangerous()); } if (self::isOnlySignaturesMode()) { CLI::writeLine('Only signatures mode enabled'); self::setExploits([]); self::setFunctions([]); } } /** * Map files. * * @return \ArrayIterator */ public function mapping() { if (!isset(self::$report['coverage']['discovered'])) { self::$report['coverage'] = self::emptyCoverage(); } $discoverWordpress = !empty(self::$settings['scan-wordpress-db']); $initialPath = is_dir(self::$pathScan) ? self::$pathScan : dirname(self::$pathScan); $this->platforms->prepare($initialPath, self::isVerifierEnabled(), $discoverWordpress); $items = []; if (is_dir(self::$pathScan)) { $directory = new \RecursiveDirectoryIterator(self::$pathScan, \FilesystemIterator::SKIP_DOTS); $items = new \RecursiveIteratorIterator( $directory, \RecursiveIteratorIterator::SELF_FIRST, \RecursiveIteratorIterator::CATCH_GET_CHILD ); } else { $items = [new \SplFileInfo(self::$pathScan)]; } $mapping = []; foreach ($items as $item) { self::touchScanHeartbeat(); if ($item->isDir()) { $this->platforms->discoverDirectory($item->getPathname(), self::isVerifierEnabled(), $discoverWordpress); continue; } if (!$item->isFile()) { continue; } self::$report['coverage']['discovered']++; if (self::isPathExcluded($item->getPathname())) { self::$report['coverage']['skipped']++; self::$report['coverage']['reasons']['path']++; continue; } $extension = strtolower($item->getExtension()); $isArchive = !empty(self::$settings['scan-archives']) && $extension === 'zip'; if (!self::isScanAll() && !$isArchive && !in_array($extension, self::getExtensions(), true)) { self::$report['coverage']['skipped']++; self::$report['coverage']['reasons']['extension']++; continue; } self::$report['coverage']['eligible']++; if (self::isVerifierEnabled() && $this->platforms->isVerified($item->getPathname())) { self::$report['coverage']['verified']++; self::$report['coverage']['skipped']++; self::$report['verifiedByChecksum']++; continue; } $mapping[] = $item; } usort($mapping, static function ($left, $right) { return strcmp(str_replace('\\', '/', $left->getPathname()), str_replace('\\', '/', $right->getPathname())); }); return (new \ArrayObject($mapping))->getIterator(); } private static function isPathExcluded($path) { if (!empty(self::$scanPathFilters)) { $matchesScanPath = false; foreach (self::$scanPathFilters as $scanPath) { if (strpos($path, $scanPath) === 0) { $matchesScanPath = true; break; } } if (!$matchesScanPath) { return true; } } foreach (self::$ignorePaths as $ignorePath) { if (self::matchesPathPattern($path, $ignorePath)) { return true; } } foreach (self::$filterPaths as $filterPath) { if (!self::matchesPathPattern($path, $filterPath)) { return true; } } return false; } private static function matchesPathPattern($path, $pattern) { $pattern = str_replace('\*', '.*?', preg_quote($pattern, ';')); return (bool)preg_match(';' . $pattern . ';i', $path); } /** * Detect infected favicon. * * @return bool */ public static function isInfectedFavicon($file) { // Case favicon_[random chars].ico $fileName = $file->getFilename(); $fileExtension = $file->getExtension(); return ((strpos($fileName, 'favicon_') === 0) && ($fileExtension === 'ico') && (strlen($fileName) > 12)) || preg_match('/^\.[\w]+\.ico/i', trim($fileName)); } /** * Get the cache key for a scanned path. * * @return string */ protected static function getScanCacheKey($info) { $filePath = realpath($info->getPathname()); if ($filePath === false) { $filePath = $info->getPathname(); } $filePath = str_replace('\\', '/', $filePath); if (DIRECTORY_SEPARATOR === '\\') { $filePath = strtolower($filePath); } return 'scan-result-v' . self::SCAN_CACHE_VERSION . '-' . hash('sha256', $filePath); } /** * Fingerprint everything that can change a scan verdict. * * @return string */ protected static function getScanCacheFingerprint() { if (self::$scanCacheFingerprint === null) { $projectRoot = dirname(__DIR__, 2); $sourceRoot = $projectRoot . DIRECTORY_SEPARATOR . 'src'; $definitionRoot = $projectRoot . DIRECTORY_SEPARATOR . 'definitions' . DIRECTORY_SEPARATOR . 'src'; $platformRoot = $sourceRoot . DIRECTORY_SEPARATOR . 'Platform'; $processProviders = glob( $sourceRoot . DIRECTORY_SEPARATOR . 'Platform' . DIRECTORY_SEPARATOR . '*' . DIRECTORY_SEPARATOR . 'ProcessApiProvider.php' ); $processProviders = $processProviders === false ? [] : $processProviders; sort($processProviders); $sourceHashes = []; $sourceFiles = array_merge([ __FILE__, $sourceRoot . DIRECTORY_SEPARATOR . 'Detection' . DIRECTORY_SEPARATOR . 'ArithmeticEvaluator.php', $sourceRoot . DIRECTORY_SEPARATOR . 'Detection' . DIRECTORY_SEPARATOR . 'CodeMatch.php', $sourceRoot . DIRECTORY_SEPARATOR . 'Detection' . DIRECTORY_SEPARATOR . 'Deobfuscator.php', $sourceRoot . DIRECTORY_SEPARATOR . 'Reputation' . DIRECTORY_SEPARATOR . 'DomainExtractor.php', $sourceRoot . DIRECTORY_SEPARATOR . 'Reputation' . DIRECTORY_SEPARATOR . 'DomainScanner.php', $sourceRoot . DIRECTORY_SEPARATOR . 'Detection' . DIRECTORY_SEPARATOR . 'Signatures.php', $sourceRoot . DIRECTORY_SEPARATOR . 'Detection' . DIRECTORY_SEPARATOR . 'Exploits.php', $sourceRoot . DIRECTORY_SEPARATOR . 'Definitions' . DIRECTORY_SEPARATOR . 'RuleData.php', $sourceRoot . DIRECTORY_SEPARATOR . 'Definitions' . DIRECTORY_SEPARATOR . 'DefinitionBundleStore.php', $platformRoot . DIRECTORY_SEPARATOR . 'ProcessDetector.php', $platformRoot . DIRECTORY_SEPARATOR . 'ProcessCommandAnalyzer.php', $platformRoot . DIRECTORY_SEPARATOR . 'ProcessApiProviderInterface.php', $platformRoot . DIRECTORY_SEPARATOR . 'ProcessApiProviderAbstract.php', $definitionRoot . DIRECTORY_SEPARATOR . 'manifest.json', $definitionRoot . DIRECTORY_SEPARATOR . 'signatures.json', $definitionRoot . DIRECTORY_SEPARATOR . 'exploits.json', $definitionRoot . DIRECTORY_SEPARATOR . 'hashes.json', ], $processProviders); foreach ($sourceFiles as $sourceFile) { if (is_file($sourceFile)) { $relativePath = substr($sourceFile, strlen($projectRoot) + 1); $sourceHashes[str_replace('\\', '/', $relativePath)] = hash_file('sha256', $sourceFile); } } $configuration = [ 'version' => self::SCAN_CACHE_VERSION, 'php' => PHP_VERSION, 'pcre' => defined('PCRE_VERSION') ? PCRE_VERSION : null, 'pcre-backtrack-limit' => ini_get('pcre.backtrack_limit'), 'pcre-recursion-limit' => ini_get('pcre.recursion_limit'), 'pcre-jit' => ini_get('pcre.jit'), 'mbstring' => extension_loaded('mbstring'), 'zlib' => extension_loaded('zlib'), 'scan-exploits' => self::shouldScanExploits(), 'exploits' => self::shouldScanExploits() ? self::$exploits : [], 'javascript' => Exploits::getJavascript(), 'scan-signatures' => self::shouldScanSignatures(), 'signatures' => self::shouldScanSignatures() ? Signatures::getAll() : [], 'scan-functions' => self::shouldScanFunctions(), 'functions' => self::shouldScanFunctions() ? self::$functions : [], 'functions-encoded' => self::shouldScanFunctions() ? self::$functionsEncoded : [], 'scan-domains' => self::shouldScanDomains(), 'domain-analysis-scope' => isset(self::$settings['domain-analysis-scope']) ? self::$settings['domain-analysis-scope'] : 'all', 'maltrail-domain-index' => self::$maltrailDefinitions !== null ? self::$maltrailDefinitions->getMetadata()['index_sha256'] : null, 'definition-bundle' => self::$definitionBundleMetadata, 'source' => $sourceHashes, ]; self::$scanCacheFingerprint = hash('sha256', serialize($configuration)); } return self::$scanCacheFingerprint; } /** * Scan file. * * @return array */ public function scanFile($info) { $patternFound = []; $filePath = $info->getPathname(); $this->supplementalFindings = []; $sourceSizeFinding = $this->platforms->sourceSizeFinding($filePath, $info->getSize()); if ($sourceSizeFinding !== null) { return $this->scanOversizedScript($filePath, $sourceSizeFinding); } $deobfuscator = new Deobfuscator(); $contentRaw = file_get_contents($filePath); if (!is_string($contentRaw)) { throw new \RuntimeException(sprintf('Unable to read "%s".', $filePath)); } $cache = null; $cacheKey = null; $contentHash = null; $fingerprint = null; if (self::isCacheEnabled()) { $cache = Cache::getInstance(); $cacheKey = self::getScanCacheKey($info); $contentHash = hash('sha256', $contentRaw); $fingerprint = hash('sha256', $contentHash . "\0" . $info->getFilename() . "\0" . self::getScanCacheFingerprint()); $cached = $cache->get($cacheKey); if (is_array($cached) && isset($cached['fingerprint'], $cached['matches']) && is_string($cached['fingerprint']) && is_array($cached['matches']) && hash_equals($cached['fingerprint'], $fingerprint)) { $this->supplementalFindings = isset($cached['findings']) && is_array($cached['findings']) ? $cached['findings'] : []; $this->supplementalFindings = array_values(array_filter( $this->supplementalFindings, static function ($finding) { return !is_array($finding) || !isset($finding['rule_id']) || $finding['rule_id'] !== 'integrity:historical-core'; } )); $this->supplementalFindings = array_merge( $this->supplementalFindings, $this->platforms->binarySignatureFindings($filePath) ); self::$report['coverage']['cached']++; return $cached['matches']; } } if (strtolower($info->getExtension()) === 'js' && !self::isScanAll()) { $patternFound = $this->scanJavascriptDefinitions($contentRaw); if (self::shouldScanDomainsForPath($filePath)) { $this->supplementalFindings = $this->scanDomains($contentRaw, $filePath); } $currentContentHash = $cache === null ? false : hash_file('sha256', $filePath); if ($cache !== null && is_string($currentContentHash) && hash_equals($contentHash, $currentContentHash)) { $cache->set($cacheKey, [ 'fingerprint' => $fingerprint, 'matches' => $patternFound, 'findings' => $this->supplementalFindings, ], self::SCAN_CACHE_TTL); } return $patternFound; } $contentClean = php_strip_whitespace($filePath); $contentDeobfuscated = $deobfuscator->deobfuscate($contentClean); $contentDecoded = $deobfuscator->decode($contentDeobfuscated); $contents = [ 'raw' => $contentRaw, // Original content 'cleaned' => $contentClean, // Cleaned content 'deobfuscated' => $contentDeobfuscated, // Deobfuscated content 'decoded' => $contentDecoded, // Decoded content ]; // For clean files the cleaned, deobfuscated and decoded variants are // usually identical, so scanning each duplicate repeats the same regex // work. Matches only depend on the scanned bytes, so duplicates can be // dropped for the exploit and signature passes. $scanContents = array_unique($contents); $codeContexts = []; $codeContext = static function ($contentType, $content) use (&$codeContexts) { if (!isset($codeContexts[$contentType])) { $codeContexts[$contentType] = new PhpCodeContext($content); } return $codeContexts[$contentType]; }; $keywordFindings = []; $encodedNameFindings = []; $exploitCandidates = []; $contentHashSource = str_replace(["\r\n", "\r"], "\n", $contentRaw); $sha256 = hash('sha256', $contentHashSource); $builtInHash = Signatures::findKnownMalwareHash('sha256', $sha256); if ($builtInHash !== null) { $patternFound['builtin-hash-' . $builtInHash['id']] = [ 'type' => 'hash', 'key' => $builtInHash['id'], 'level' => $builtInHash['severity'], 'output' => $builtInHash['description'], 'description' => $builtInHash['description'], 'line' => null, 'pattern' => 'sha256:' . $sha256, 'match' => $sha256, 'provider' => 'builtin-corpus', ]; } $md5 = md5($contentHashSource); if (Signatures::matchesKnownMalwareMd5($md5)) { $prefix = substr($md5, 0, 8); $this->supplementalFindings[] = Finding::create( 'hash-candidate', $filePath, 'known-malware-md5-prefix-' . $prefix, 'warn', 'The file MD5 prefix matches a known-malware candidate index and requires confirmation.', [ 'confirmed' => false, 'md5' => $md5, 'md5_prefix' => $prefix, 'content_hash' => $sha256, ], 'builtin-signatures' ); } $this->supplementalFindings = array_merge( $this->supplementalFindings, $this->platforms->binarySignatureFindings($filePath) ); if (self::shouldScanDomainsForPath($filePath)) { $this->supplementalFindings = array_merge( $this->supplementalFindings, $this->scanDomains($contentRaw, $filePath) ); } /** * Scan exploits. */ if (self::shouldScanExploits()) { foreach (self::$exploits as $key => $exploit) { $lastMatch = null; $pattern = $exploit['pattern']; $checkExploit = function ($match, $lineNumber = null) use ($contentRaw, $exploit, $pattern, $key, &$patternFound) { $type = 'exploit'; $lastMatch = $match[0]; $patternFoundKey = $type . $key; if ($lineNumber === null) { $lineNumber = CodeMatch::getLineNumber($lastMatch, $contentRaw); } if ($lineNumber !== null) { $patternFoundKey .= $lineNumber; } if (is_string($lastMatch) && $lastMatch !== '') { $patternFound[$patternFoundKey] = [ 'type' => $type, 'key' => $key, 'level' => $exploit['level'], 'output' => CodeMatch::getText($type, $key, $exploit['description'], $lastMatch, $lineNumber), 'description' => $exploit['description'], 'line' => $lineNumber, 'pattern' => $pattern, 'match' => $lastMatch, ]; if (isset($exploit['link'])) { $patternFound[$patternFoundKey]['link'] = $exploit['link']; } } }; // Check exploits foreach ($scanContents as $contentType => $content) { $matches = []; if (self::isLiteMode() && $key === 'execution') { $matches[0] = Exploits::matchLiteExecution($pattern, $content, $codeContext($contentType, $content)); } elseif ($key === 'non_printable') { $matches[0] = Exploits::matchNonPrintable($pattern, $content); } elseif (!@preg_match_all($pattern, $content, $matches, PREG_OFFSET_CAPTURE)) { $matches = []; } if (!empty($matches[0])) { $lineNumbers = $contentType === 'raw' ? CodeMatch::getLineNumbers(array_column($matches[0], 1), $contentRaw) : []; foreach ($matches[0] as $index => $match) { $start = $match[1] + strlen($match[0]) - strlen(ltrim($match[0])); if (Exploits::requiresPhpContext($key, self::isLiteMode()) && !$codeContext($contentType, $content)->isCode($start)) { continue; } $lineNumber = isset($lineNumbers[$index]) ? $lineNumbers[$index] : null; if (self::isLiteMode() && Exploits::isLiteCandidate($key, $exploit, $match[0])) { if (!isset($exploitCandidates[$key])) { $exploitCandidates[$key] = Finding::create( 'exploit-candidate', $filePath, 'exploit:' . $key, 'info', 'Lite heuristic matched; execution or malicious intent requires further evidence.', [ 'confirmed' => false, 'description' => $exploit['description'], 'match' => $match[0], 'line' => $lineNumber !== null ? $lineNumber : CodeMatch::getLineNumber($match[0], $contentRaw), ], 'builtin-exploits' ); } continue; } $checkExploit($match, $lineNumber); } } } } } if (self::shouldScanExploits() || self::shouldScanFunctions()) { foreach ($this->platforms->processFindings($contentRaw) as $detection) { $type = 'process'; $key = $detection['key']; $lineNumber = $detection['line']; $patternFoundKey = $type . $key . $lineNumber . '_' . $detection['offset']; $processFinding = [ 'type' => $type, 'key' => $key, 'level' => $detection['level'], 'output' => CodeMatch::getText($type, $key, $detection['description'], $detection['match'], $lineNumber), 'description' => $detection['description'], 'line' => $lineNumber, 'pattern' => 'context-aware PHP token analysis', 'match' => $detection['match'], 'provider' => 'builtin-framework-process', 'platform' => $detection['platform'], 'api' => $detection['api'], 'method' => $detection['method'], ]; if (isset($detection['threat'])) { $processFinding['threat'] = $detection['threat']; } $patternFound[$patternFoundKey] = $processFinding; } } /** * Scan definitions. */ if (self::shouldScanSignatures()) { foreach (Signatures::getAll() as $key => $pattern) { $signatureHash = hash('crc32b', (string)$key); if (self::isLiteMode() && in_array($signatureHash, self::LITE_SIGNATURE_EXCLUSIONS, true)) { continue; } $lastMatch = null; $regexPattern = '#' . $pattern . '#smiS'; $checkDefinitions = function ($match, $lineNumber = null) use ($contentRaw, $signatureHash, $regexPattern, &$patternFound) { $type = 'sign'; $key = $signatureHash; $lastMatch = $match[0]; $patternFoundKey = $type . $key; if ($lineNumber === null) { $lineNumber = CodeMatch::getLineNumber($lastMatch, $contentRaw); } if ($lineNumber !== null) { $patternFoundKey .= $lineNumber; } if (is_string($lastMatch) && $lastMatch !== '') { $descriptionPrefix = 'Signature'; $description = 'Malware Signature (hash: ' . $key . ')'; $patternFound[$patternFoundKey] = [ 'type' => $type, 'key' => $key, 'level' => CodeMatch::DANGEROUS, 'output' => CodeMatch::getText($descriptionPrefix, $key, $description, $lastMatch, $lineNumber), 'description' => $description, 'line' => $lineNumber, 'pattern' => $regexPattern, 'match' => $lastMatch, ]; } }; // Check definitions foreach ($scanContents as $contentType => $content) { if (@preg_match_all($regexPattern, $content, $matches, PREG_OFFSET_CAPTURE)) { $lineNumbers = $contentType === 'raw' ? CodeMatch::getLineNumbers(array_column($matches[0], 1), $contentRaw) : []; foreach ($matches[0] as $index => $match) { $keyword = strtolower($match[0]); if (in_array($keyword, self::GENERIC_SIGNATURE_KEYWORDS, true)) { if ($contentType === 'raw' && preg_match('/\G(? false, 'match' => $match[0], 'line' => $lineNumbers[$index]], 'builtin-signatures' ); } continue; } $checkDefinitions($match, isset($lineNumbers[$index]) ? $lineNumbers[$index] : null); } } } } } /** * Scan functions. */ if (self::shouldScanFunctions()) { $functions = array_merge(self::$functionsEncoded, self::$functions); foreach ($functions as $funcRaw) { $lastMatch = null; $checkFunction = function ( $match, $pattern, $level = CodeMatch::WARNING, $descriptionPrefix = '', $functionType = '' ) use ($contentRaw, $funcRaw, &$patternFound) { $type = 'function'; $suffix = ''; if (!empty($functionType)) { $suffix = '_' . $functionType; } $lastMatch = CodeMatch::cleanFunctionResult($match[0]); // Clean match $funcKey = $funcRaw . $suffix; $patternFoundKey = $type . $funcKey; $lineNumber = CodeMatch::getLineNumber($lastMatch, $contentRaw); if ($lineNumber !== null) { $patternFoundKey .= $lineNumber; } if (!empty($lastMatch) && empty($patternFound[$patternFoundKey])) { $description = $descriptionPrefix . ' `' . $funcRaw . '`'; $patternFound[$patternFoundKey] = [ 'type' => trim($type . ' ' . $functionType), 'key' => $funcKey, 'level' => $level, 'output' => CodeMatch::getText($type, $funcRaw, $description, $lastMatch, $lineNumber), 'description' => $description, 'line' => $lineNumber, 'pattern' => $pattern, 'match' => $lastMatch, 'link' => 'https://www.php.net/' . $funcRaw, ]; } }; /** * Functions. */ if (in_array($funcRaw, self::$functionsEncoded, true)) { $encoders = [ 'str_rot13', 'base64_decode', 'strrev', ]; $regexPattern = CodeMatch::patternFunctionStart($funcRaw); foreach ($scanContents as $contentType => $content) { if (@preg_match_all($regexPattern, $content, $matches, PREG_OFFSET_CAPTURE)) { foreach ($matches[0] as $match) { $context = $codeContext($contentType, $content); if (!$context->isCode($match[1])) { continue; } $match[0] = $context->callText($content, $match[1], strlen($match[0])); $decoded = $contentType === 'decoded'; $checkFunction( $match, $regexPattern, $decoded ? CodeMatch::DANGEROUS : CodeMatch::WARNING, $decoded ? 'Encoded Function' : 'Potentially dangerous function' ); } } foreach ($encoders as $encoder) { $key = $funcRaw . $encoder; if (!isset(self::$functionsEncodedValues[$key])) { self::$functionsEncodedValues[$key] = [ 'call' => CodeMatch::patternEncodedFunction($funcRaw, $encoder), 'value' => CodeMatch::patternEncodedFunctionValue($funcRaw, $encoder), ]; } $patterns = self::$functionsEncodedValues[$key]; if ($contentType === 'raw' && preg_match($patterns['value'], $content, $candidate, PREG_OFFSET_CAPTURE)) { $encodedNameFindings[$key] = Finding::create( 'encoded-function-candidate', $filePath, 'encoded-function:' . $funcRaw . ':' . $encoder, 'info', 'Encoded function name found; decoding or execution requires further evidence.', [ 'confirmed' => false, 'function' => $funcRaw, 'decoder' => $encoder, 'match' => $candidate[0][0], 'line' => CodeMatch::getLineNumber($candidate[0][0], $contentRaw, $candidate[0][1]), ], 'builtin-functions' ); } $regexPatternEncoded = $patterns['call']; if (@preg_match_all($regexPatternEncoded, $content, $matches, PREG_OFFSET_CAPTURE)) { foreach ($matches[0] as $match) { if (!$codeContext($contentType, $content)->isCode($match[1])) { continue; } $checkFunction( $match, $regexPatternEncoded, CodeMatch::DANGEROUS, 'Encoded Function', $encoder ); } } } } } } } if (self::shouldScanExploits() && self::isInfectedFavicon($info)) { $type = 'exploit'; $key = 'infected_icon'; $description = 'LFI (Local File Inclusion), through an infected file with icon, allow remote attackers to inject and execute arbitrary commands or code on the target machine'; $patternFound[$key] = [ 'type' => $type, 'key' => $key, 'level' => CodeMatch::DANGEROUS, 'output' => CodeMatch::getText($type, $key, $description, ''), 'description' => $description, 'line' => null, 'pattern' => '', 'match' => '', ]; } if (strtolower($info->getExtension()) === 'js') { $patternFound = array_merge($patternFound, $this->scanJavascriptDefinitions($contentRaw)); } $this->supplementalFindings = array_merge( $this->supplementalFindings, array_values($keywordFindings), array_values($encodedNameFindings), array_values($exploitCandidates) ); // Remove duplicated without line number $result = $patternFound; foreach ($patternFound as $itemKey => $item) { foreach ($patternFound as $value) { $match1 = preg_replace('/\s+/', '', $item['match']); $match2 = preg_replace('/\s+/', '', $value['match']); if ($match1 === $match2 && $item['type'] === $value['type'] && $item['key'] === $value['key'] && empty($item['line']) && !empty($value['line']) ) { unset($result[$itemKey]); } } } $currentContentHash = $cache === null ? false : hash_file('sha256', $filePath); if ($cache !== null && is_string($currentContentHash) && hash_equals($contentHash, $currentContentHash)) { $cache->set($cacheKey, [ 'fingerprint' => $fingerprint, 'matches' => $result, 'findings' => $this->supplementalFindings, ], self::SCAN_CACHE_TTL); } return $result; } /** * Deobfuscate file. */ public function deobfuscateFile($info) { $filePath = $info->getPathname(); $deobfuscator = new Deobfuscator(); $content = php_strip_whitespace($filePath); $content = $deobfuscator->deobfuscate($content); $content = $deobfuscator->decode($content); $scanPath = realpath(self::getPathScan()); if (is_file($scanPath)) { $scanPath = dirname($scanPath); } $filePath = self::getPathDeobfuscate() . DIRECTORY_SEPARATOR . str_replace($scanPath, '', realpath($filePath)); $filePath = Path::get($filePath); $concurrentDirectory = dirname($filePath); if (!is_dir($concurrentDirectory) && (!mkdir($concurrentDirectory, 0755, true) && !is_dir($concurrentDirectory))) { throw new \RuntimeException(sprintf('Directory "%s" was not created', $concurrentDirectory)); } Actions::putContents($filePath, $content); } /** * Run index.php. */ private function scan($iterator) { self::$lastHeartbeatWrite = 0.0; self::touchScanHeartbeat(true); $items = []; foreach ($iterator as $item) { $items[] = $item; self::touchScanHeartbeat(); } $filesCount = count($items); $startIndex = !empty(self::$settings['offset']) ? (int)self::$settings['offset'] : 0; $limit = !empty(self::$settings['limit']) ? (int)self::$settings['limit'] : null; $checkpointStore = self::$pathCheckpoint === null ? null : new CheckpointStore(self::$pathCheckpoint); // Build candidate identity only for resumable runs that persist checkpoints. $manifestHash = null; $configurationHash = null; $resumeStartedAt = null; $completedChunks = []; if ($checkpointStore !== null) { $manifestHash = self::candidateManifestHash($items); $configurationHash = self::checkpointConfigurationHash(); if (!empty(self::$settings['resume'])) { $checkpoint = $checkpointStore->load($manifestHash, $configurationHash); if (is_array($checkpoint) && $checkpoint['next_index'] <= $filesCount) { self::$report = $checkpoint['report']; $startIndex = $checkpoint['next_index']; if (isset($checkpoint['completed_chunks']) && is_array($checkpoint['completed_chunks'])) { $completedChunks = $checkpoint['completed_chunks']; } if (isset($checkpoint['progress']['started_at']) && is_string($checkpoint['progress']['started_at']) && strtotime($checkpoint['progress']['started_at']) !== false) { $resumeStartedAt = $checkpoint['progress']['started_at']; } } } } if (!empty(self::$settings['offset']) && $startIndex === (int)self::$settings['offset']) { self::$report['scanned'] = $startIndex; self::$report['coverage']['scanned'] = $startIndex; } $endIndex = $limit === null ? $filesCount : min($filesCount, $startIndex + $limit); $progressStartedAt = $resumeStartedAt ?: gmdate('c'); self::$lastCheckpointIndex = null; self::$lastCheckpointWrite = 0.0; self::$checkpointCompletedChunks = null; self::$report['coverage']['complete'] = false; // Parallel report-only scanning $parallelJobs = $this->parallelJobCount($filesCount, $startIndex, $endIndex); if ($parallelJobs > 1) { $this->scanReportInParallel( $items, $startIndex, $endIndex, $filesCount, $parallelJobs, $checkpointStore, $manifestHash, $configurationHash, $progressStartedAt, $completedChunks ); self::finalizeScanCheckpoint( $checkpointStore, $manifestHash, $configurationHash, $endIndex, $filesCount, $progressStartedAt ); return; } if ($completedChunks !== []) { list($restoredChunks) = self::buildParallelChunkPlan( $startIndex, $filesCount, count($completedChunks) + 1, $completedChunks ); self::$checkpointCompletedChunks = array_values(array_filter( $restoredChunks, static function ($chunk) use ($endIndex) { return $chunk['start'] >= $endIndex || $chunk['end'] <= $endIndex; } )); } // Scanning for ($index = $startIndex; $index < $endIndex; $index++) { self::touchScanHeartbeat(); $control = self::scanControlRequest(); if ($control !== null) { self::saveScanCheckpoint($checkpointStore, $manifestHash, $configurationHash, $index, $filesCount, $progressStartedAt, true); throw new \RuntimeException('Scan ' . $control . ' by administrator.'); } if (is_array(self::$checkpointCompletedChunks) && isset(self::$checkpointCompletedChunks[0]) && self::$checkpointCompletedChunks[0]['start'] === $index) { $chunk = array_shift(self::$checkpointCompletedChunks); self::mergeWorkerDelta($chunk['delta']); self::saveScanCheckpoint( $checkpointStore, $manifestHash, $configurationHash, $chunk['end'], $filesCount, $progressStartedAt, true ); $index = $chunk['end'] - 1; continue; } $info = $items[$index]; CLI::progress(self::$report['scanned'], $filesCount); $filePath = $info->getPathname(); $fileExtension = strtolower($info->getExtension()); $fileSize = filesize($filePath); if (self::isDeobfuscateMode()) { self::$report['scanned']++; self::$report['coverage']['scanned'] = self::$report['scanned']; usleep(10); $this->deobfuscateFile($info); self::saveScanCheckpoint($checkpointStore, $manifestHash, $configurationHash, $index + 1, $filesCount, $progressStartedAt); continue; } if (!empty(self::$settings['scan-archives']) && $fileExtension === 'zip') { $this->scanArchiveFile($info); self::$report['scanned']++; self::$report['coverage']['scanned'] = self::$report['scanned']; self::saveScanCheckpoint($checkpointStore, $manifestHash, $configurationHash, $index + 1, $filesCount, $progressStartedAt); continue; } $isFavicon = self::isInfectedFavicon($info); if (( (self::isScanAll() || in_array($fileExtension, self::$extensions, true)) && (self::$maxFilesize < 1 || $fileSize <= self::$maxFilesize) && (!file_exists(self::$pathQuarantine) || strpos(realpath($filePath), realpath(self::$pathQuarantine)) === false) /* && (strpos($fileName, '-') === FALSE) */ ) || $isFavicon) { $patternFound = $this->scanFile($info); if (!empty($this->supplementalFindings)) { self::$report['findings'] = array_merge(self::$report['findings'], $this->supplementalFindings); } // Check whitelist $inWhitelist = Whitelist::countMatches( self::$whitelist, $filePath, $patternFound, self::isOnlyPathWhitelistMode(), self::getPathScan() ); // Scan finished self::$report['scanned']++; self::$report['coverage']['scanned'] = self::$report['scanned']; usleep(10); if (realpath($filePath) !== realpath(__FILE__) && ($isFavicon || !empty($patternFound)) && ($inWhitelist === 0 || $inWhitelist !== count($patternFound))) { self::$report['detected']++; self::$report['infectedFound'][$filePath] = $patternFound; self::addMalwareFindings($filePath, $patternFound, $isFavicon); $fileHash = hash_file('sha256', $filePath); if (is_string($fileHash)) { self::$report['fileHashes'][$filePath] = $fileHash; } if (self::isReportMode()) { // Scan mode only self::$report['ignored'][] = 'File: ' . $filePath . PHP_EOL . 'Exploits:' . PHP_EOL . ' => ' . implode(PHP_EOL . ' => ', array_column($patternFound, 'output')); self::saveScanCheckpoint($checkpointStore, $manifestHash, $configurationHash, $index + 1, $filesCount, $progressStartedAt); continue; } // Scan with code check $inLoop = true; $fileContent = file_get_contents($filePath); CLI::newLine(2); CLI::writeBreak(); CLI::writeLine('PROBABLE MALWARE FOUND!', 1, 'red'); $previewLines = explode(CLI::eol(1), trim($fileContent)); $preview = implode(CLI::eol(1), array_slice($previewLines, 0, 1000)); CLI::displayLine($filePath, 2, 'yellow'); $title = CLI::title(' PREVIEW ', '='); CLI::display($title, 'white', 'red'); CLI::newLine(2); CLI::code($preview, $patternFound); if (count($previewLines) > 1000) { CLI::newLine(2); CLI::display(' [ ' . (count($previewLines) - 1000) . ' more lines not shown ]', 'yellow'); } CLI::newLine(2); $title = CLI::title('', '='); CLI::display($title, 'white', 'red'); CLI::newLine(2); CLI::writeLine('Checksum: ' . md5_file($filePath), 1, 'yellow'); CLI::writeLine('File path: ' . $filePath, 2, 'yellow'); CLI::writeLine('Evil code found: ' . CLI::eol(1) . implode(CLI::eol(1), array_column($patternFound, 'output')), 2, 'red'); while ($inLoop) { $fileContent = file_get_contents($filePath); CLI::displayLine('OPTIONS:', 2); $confirmation = self::$prompt; if (self::$prompt === null) { $confirmation = CLI::choice('What is your choice? ', [ 1 => 'Delete file', 2 => 'Move to quarantine', 3 => 'Dry run evil code fixer', 4 => 'Dry run evil line code fixer', 5 => 'Open with vim', 6 => 'Open with nano', 7 => 'Add to whitelist', 8 => 'Show source', '-' => 'Ignore', ]); if (empty(trim($confirmation))) { $confirmation = '0'; } } CLI::newLine(); unset($previewLines, $preview); switch (true) { // Remove file case in_array($confirmation, ['1', 'delete']): CLI::writeLine('File path: ' . $filePath, 1, 'yellow'); $confirm2 = 'y'; if (self::$prompt === null) { $confirm2 = CLI::read('Want delete this file [y|N]? ', 'purple'); } CLI::newLine(); if ($confirm2 === 'y') { if (FileRemediator::deleteFile($filePath)) { self::$report['removed'][] = $filePath; CLI::writeLine("File '$filePath' removed!", 2, 'green'); $inLoop = false; } else { CLI::writeLine("File '$filePath' could not be removed!", 2, 'red'); if (self::$prompt !== null) { self::$report['ignored'][] = $filePath; $inLoop = false; } } } break; // Move to quarantine case in_array($confirmation, ['2', 'quarantine']): $quarantine = FileRemediator::moveToQuarantine($filePath); if ($quarantine === false) { CLI::writeLine("File '$filePath' could not be moved to quarantine!", 2, 'red'); if (self::$prompt !== null) { self::$report['ignored'][] = $filePath; self::$report['infectedFound'][$filePath] = $patternFound; $inLoop = false; } break; } self::$report['quarantine'][] = $quarantine; CLI::writeLine("File '$filePath' moved to quarantine!", 2, 'green'); $inLoop = false; break; // Remove evil code case in_array($confirmation, ['3', 'clean']) && count($patternFound) > 0: $fixedContent = FileRemediator::cleanEvilCode($fileContent, $patternFound); $this->saveFixedContent($filePath, $fileContent, $fixedContent, $info, $patternFound, $inLoop); break; // Remove evil line code case in_array($confirmation, ['4', 'clean-line']) && count($patternFound) > 0: $fixedContent = FileRemediator::cleanEvilCodeLine($fileContent, $patternFound); $this->saveFixedContent($filePath, $fileContent, $fixedContent, $info, $patternFound, $inLoop); break; // Open with vim case in_array($confirmation, ['5', 'vim']): $this->editAndVerifyFile('vim', $info, $patternFound, $inLoop); break; // Open with nano case in_array($confirmation, ['6', 'nano']): $this->editAndVerifyFile('nano', $info, $patternFound, $inLoop); break; // Add to whitelist case in_array($confirmation, ['7', 'whitelist']): if (FileRemediator::addToWhitelist($filePath, $patternFound)) { self::$report['whitelist'][] = $filePath; CLI::writeLine("Exploits of file '$filePath' added to whitelist!", 2, 'green'); $inLoop = false; } else { CLI::writeLine("Exploits of file '$filePath' failed adding file to whitelist! Check write permission of '" . self::$pathWhitelist . "' file!", 2, 'red'); if (self::$prompt !== null) { self::$report['ignored'][] = $filePath; $inLoop = false; } } break; // Show source code case in_array($confirmation, ['8', 'show']): CLI::newLine(); CLI::displayLine("File path: $filePath", 2, 'yellow'); $title = CLI::title(' SOURCE ', '='); CLI::display($title, 'white', 'red'); CLI::newLine(2); CLI::code($fileContent, $patternFound); CLI::newLine(2); $title = CLI::title('', '='); CLI::display($title, 'white', 'red'); CLI::newLine(2); CLI::displayLine("File path: $filePath", 2, 'yellow'); break; // Skip case in_array($confirmation, ['0', '-', 'skip']): CLI::writeLine("File '$filePath' skipped!", 2, 'green'); self::$report['ignored'][] = $filePath; self::$report['infectedFound'][$filePath] = $patternFound; $inLoop = false; break; default: CLI::writeLine('Option not found! Retry...', 1, 'red'); break; } CLI::writeBreak(); } unset($fileContent); } } else { self::$report['coverage']['skipped']++; if (self::$maxFilesize > 0 && $fileSize > self::$maxFilesize) { self::$report['coverage']['reasons']['oversized']++; } else { self::$report['coverage']['reasons']['excluded']++; } } self::saveScanCheckpoint($checkpointStore, $manifestHash, $configurationHash, $index + 1, $filesCount, $progressStartedAt); } self::finalizeScanCheckpoint( $checkpointStore, $manifestHash, $configurationHash, $endIndex, $filesCount, $progressStartedAt ); } private static function finalizeScanCheckpoint( $checkpointStore, $manifestHash, $configurationHash, $endIndex, $filesCount, $progressStartedAt ) { self::touchScanHeartbeat(true); self::$report['coverage']['complete'] = $endIndex >= $filesCount; $control = self::scanControlRequest(); if ($control !== null) { if ($checkpointStore !== null) { if ($control === 'cancelled') { $checkpointStore->clear(); } else { self::saveScanCheckpoint( $checkpointStore, $manifestHash, $configurationHash, $endIndex, $filesCount, $progressStartedAt, true ); } } throw new \RuntimeException('Scan ' . $control . ' by administrator.'); } if ($checkpointStore === null) { return; } if (self::$report['coverage']['complete']) { $checkpointStore->clear(); } else { self::saveScanCheckpoint( $checkpointStore, $manifestHash, $configurationHash, $endIndex, $filesCount, $progressStartedAt, true ); } } /** * Resolve the number of worker processes usable for the current scan. * * Parallelism is limited to non-interactive report-only scans. Interactive * remediation, archive/deobfuscate jobs and single-process environments * fall back to sequential scanning. During parallel scans the parent owns * the resumable checkpoint and workers only publish partial reports. * * @return int Number of worker processes (1 means sequential scanning) */ private function parallelJobCount($filesCount, $startIndex, $endIndex) { if (!self::isReportMode()) { return 1; } $configured = isset(self::$settings['jobs']) ? (int)self::$settings['jobs'] : 1; if ($configured < 2) { return 1; } if (self::isDeobfuscateMode() || !empty(self::$settings['scan-archives'])) { return 1; } if (self::isLogEnabled() || $this->parallelProcessBlocker() !== null) { return 1; } if (!self::isParallelProcessingAvailable()) { CLI::writeLine('Warning: --jobs requested, but the required pcntl functions are unavailable or disabled. Falling back to sequential scanning.', 1, 'yellow'); return 1; } $total = $endIndex - $startIndex; if ($total < self::PARALLEL_MIN_FILES) { return 1; } return min($configured, $total); } private function parallelProcessBlocker() { if (!empty($this->ftpMirrors)) { return 'ftp-mirror'; } if (!self::isPhpFunctionAvailable('ob_get_level')) { return 'output-buffer-state'; } return ob_get_level() > 0 ? 'output-buffer' : null; } private static function isParallelProcessingAvailable() { if (!extension_loaded('pcntl')) { return false; } foreach (['pcntl_fork', 'pcntl_waitpid', 'pcntl_signal', 'pcntl_async_signals', 'pcntl_signal_get_handler', 'pcntl_get_last_error'] as $function) { if (!self::isPhpFunctionAvailable($function)) { return false; } } foreach (['WNOHANG', 'SIGINT', 'SIGTERM', 'SIG_DFL', 'PCNTL_EINTR'] as $constant) { if (!defined($constant)) { return false; } } return true; } private static function isPhpFunctionAvailable($function) { static $disabledFunctions = null; if ($disabledFunctions === null) { $disabledFunctions = array_filter(array_map('trim', explode(',', strtolower((string)ini_get('disable_functions'))))); } return !in_array(strtolower($function), $disabledFunctions, true) && function_exists($function); } /** * Split the candidate file list into contiguous chunks and scan every * chunk inside a dedicated worker process (fork). Partial worker reports * are merged back into the shared report once every worker has finished. */ private function scanReportInParallel( array $items, $startIndex, $endIndex, $filesCount, $jobs, $checkpointStore = null, $manifestHash = null, $configurationHash = null, $progressStartedAt = null, array $completedChunks = [] ) { CLI::writeLine('Scanning with ' . $jobs . ' parallel worker processes', 2); list($restoredChunks, $pendingRanges) = self::buildParallelChunkPlan( $startIndex, $endIndex, $jobs, $completedChunks ); $workers = []; foreach ($restoredChunks as $chunk) { $chunkBytes = 0; for ($index = $chunk['start']; $index < $chunk['end']; $index++) { $chunkBytes += $this->workerCandidateScanBytes($items[$index]); } $workers[] = [ 'pid' => null, 'resultFile' => null, 'statusFile' => null, 'chunkStart' => $chunk['start'], 'chunkEnd' => $chunk['end'], 'chunkTotal' => $chunk['end'] - $chunk['start'], 'chunkBytes' => $chunkBytes, 'delta' => $chunk['delta'], 'flagged' => isset($chunk['delta']['detected']) ? (int)$chunk['delta']['detected'] : 0, 'done' => true, ]; } self::saveScanCheckpoint( $checkpointStore, $manifestHash, $configurationHash, $startIndex, $filesCount, $progressStartedAt ?: gmdate('c'), true, $startIndex + self::completedWorkerFiles($workers), self::completedParallelChunks($workers) ); $terminationSignal = null; $signalState = self::installWorkerSignalHandlers($terminationSignal); $completed = false; try { $pendingQueue = array_values($pendingRanges); $active = 0; while ($active < $jobs && $pendingQueue !== []) { if ($terminationSignal !== null) { throw new \RuntimeException('Parallel scan interrupted by signal ' . $terminationSignal . '.'); } $range = array_shift($pendingQueue); $workers[] = $this->startWorkerChunk($items, $range[0], $range[1]); $active++; } $startedAt = time(); $lastProgressLine = $startedAt; $done = count($restoredChunks); $total = count($restoredChunks) + count($pendingRanges); $totalFiles = $endIndex - $startIndex; $totalBytes = 0; for ($index = $startIndex; $index < $endIndex; $index++) { $totalBytes += $this->workerCandidateScanBytes($items[$index]); } while ($done < $total) { self::touchScanHeartbeat(); $control = self::scanControlRequest(); if ($control !== null) { self::saveScanCheckpoint( $checkpointStore, $manifestHash, $configurationHash, $startIndex, $filesCount, $progressStartedAt, true, $startIndex + self::completedWorkerFiles($workers), self::completedParallelChunks($workers) ); throw new \RuntimeException('Scan ' . $control . ' by administrator.'); } if ($terminationSignal !== null) { throw new \RuntimeException('Parallel scan interrupted by signal ' . $terminationSignal . '.'); } foreach ($workers as $index => $worker) { if (!empty($worker['done'])) { continue; } if ($worker['pid'] === null) { $workers[$index]['delta'] = $worker['result']; $workers[$index]['flagged'] = is_array($worker['result']) && isset($worker['result']['detected']) ? (int)$worker['result']['detected'] : 0; $workers[$index]['done'] = true; $done++; $active--; self::saveScanCheckpoint( $checkpointStore, $manifestHash, $configurationHash, $startIndex, $filesCount, $progressStartedAt, true, $startIndex + self::completedWorkerFiles($workers), self::completedParallelChunks($workers) ); continue; } $waited = pcntl_waitpid($worker['pid'], $status, WNOHANG); if ($waited === -1 && self::wasWaitInterrupted()) { continue; } if ($waited === $worker['pid'] || $waited === -1) { $delta = $this->collectWorkerChunk($worker['resultFile'], $worker['statusFile']); if ($delta === null) { $delta = $this->runWorkerChunkInline($items, $worker['chunkStart'], $worker['chunkEnd']); } $workers[$index]['delta'] = $delta; $workers[$index]['flagged'] = is_array($delta) && isset($delta['detected']) ? (int)$delta['detected'] : 0; $workers[$index]['done'] = true; $done++; $active--; self::saveScanCheckpoint( $checkpointStore, $manifestHash, $configurationHash, $startIndex, $filesCount, $progressStartedAt, true, $startIndex + self::completedWorkerFiles($workers), self::completedParallelChunks($workers) ); } } while ($active < $jobs && $pendingQueue !== []) { $range = array_shift($pendingQueue); $workers[] = $this->startWorkerChunk($items, $range[0], $range[1]); $active++; } if ($done >= $total) { break; } $now = time(); if ($now - $lastProgressLine >= self::PARALLEL_PROGRESS_INTERVAL) { $lastProgressLine = $now; $processed = 0; $processedBytes = 0; $flagged = 0; foreach ($workers as $worker) { if (!empty($worker['done'])) { $processed += $worker['chunkTotal']; $processedBytes += isset($worker['chunkBytes']) ? $worker['chunkBytes'] : 0; $flagged += isset($worker['flagged']) ? $worker['flagged'] : 0; } else { list($workerFiles, $workerBytes, $workerFlagged) = self::readWorkerProgress($worker['statusFile']); $processed += $workerFiles; $processedBytes += $workerBytes; $flagged += $workerFlagged; } } $elapsed = $now - $startedAt; $eta = self::estimateRemainingSeconds($processed, $processedBytes, $totalFiles, $totalBytes, $elapsed); self::writeParallelProgress( $processed, $processedBytes, $totalFiles, $totalBytes, $eta, $flagged, $done, $total, $elapsed, false ); self::saveScanCheckpoint( $checkpointStore, $manifestHash, $configurationHash, $startIndex, $filesCount, $progressStartedAt, false, $startIndex + $processed, self::completedParallelChunks($workers) ); } usleep(200000); } $flagged = 0; foreach ($workers as $worker) { $flagged += isset($worker['flagged']) ? $worker['flagged'] : 0; } self::writeParallelProgress( $totalFiles, $totalBytes, $totalFiles, $totalBytes, 0, $flagged, $total, $total, time() - $startedAt, true ); self::restoreSignalHandlersBeforeWorkerMerge($signalState, $terminationSignal); self::mergeWorkerDeltasInChunkOrder($workers, $terminationSignal); $completed = true; } finally { if (!$completed) { try { self::saveScanCheckpoint( $checkpointStore, $manifestHash, $configurationHash, $startIndex, $filesCount, $progressStartedAt, true, $startIndex + self::completedWorkerFiles($workers), self::completedParallelChunks($workers) ); } finally { self::stopWorkerChunks($workers); } } self::restoreWorkerSignalHandlers($signalState); } if ($terminationSignal !== null) { throw new \RuntimeException('Parallel scan interrupted by signal ' . $terminationSignal . '.'); } } private static function buildParallelChunkPlan($startIndex, $endIndex, $jobs, array $completedChunks) { usort($completedChunks, static function ($left, $right) { return (isset($left['start']) ? $left['start'] : -1) <=> (isset($right['start']) ? $right['start'] : -1); }); $restored = []; $previousEnd = $startIndex; foreach ($completedChunks as $chunk) { if (!is_array($chunk) || !isset($chunk['start'], $chunk['end'], $chunk['delta']) || !is_int($chunk['start']) || !is_int($chunk['end']) || !is_array($chunk['delta']) || $chunk['start'] < $previousEnd || $chunk['start'] < $startIndex || $chunk['end'] <= $chunk['start'] || $chunk['end'] > $endIndex) { continue; } $restored[] = $chunk; $previousEnd = $chunk['end']; } $jobs = max(1, (int)$jobs); $pending = self::uncoveredParallelRanges($startIndex, $endIndex, $restored); while (count($pending) < $jobs) { $largestIndex = null; $largestLength = 1; foreach ($pending as $index => $range) { $length = $range[1] - $range[0]; if ($length > $largestLength) { $largestIndex = $index; $largestLength = $length; } } if ($largestIndex === null) { break; } $range = $pending[$largestIndex]; $middle = $range[0] + (int)ceil(($range[1] - $range[0]) / 2); array_splice($pending, $largestIndex, 1, [[$range[0], $middle], [$middle, $range[1]]]); } return [$restored, $pending]; } private static function uncoveredParallelRanges($startIndex, $endIndex, array $completedChunks) { $ranges = []; $cursor = $startIndex; foreach ($completedChunks as $chunk) { if ($chunk['start'] > $cursor) { $ranges[] = [$cursor, $chunk['start']]; } $cursor = $chunk['end']; } if ($cursor < $endIndex) { $ranges[] = [$cursor, $endIndex]; } return $ranges; } private static function completedParallelChunks(array $workers) { $chunks = []; foreach ($workers as $worker) { if (empty($worker['done']) || !isset($worker['delta']) || !is_array($worker['delta'])) { continue; } $chunks[] = [ 'start' => $worker['chunkStart'], 'end' => $worker['chunkEnd'], 'delta' => $worker['delta'], ]; } usort($chunks, static function ($left, $right) { return $left['start'] <=> $right['start']; }); return $chunks; } private static function completedWorkerFiles(array $workers) { $completed = 0; foreach ($workers as $worker) { if (!empty($worker['done']) && isset($worker['chunkTotal'])) { $completed += (int)$worker['chunkTotal']; } } return $completed; } private static function restoreSignalHandlersBeforeWorkerMerge(&$signalState, &$terminationSignal) { if ($terminationSignal !== null) { throw new \RuntimeException('Parallel scan interrupted by signal ' . $terminationSignal . '.'); } // All children have been reaped, so restore the caller's handlers // before a potentially large ordered merge can receive a signal. self::restoreWorkerSignalHandlers($signalState); $signalState = null; if ($terminationSignal !== null) { throw new \RuntimeException('Parallel scan interrupted by signal ' . $terminationSignal . '.'); } } private static function mergeWorkerDeltasInChunkOrder(array $workers, &$terminationSignal) { usort($workers, static function ($left, $right) { return $left['chunkStart'] <=> $right['chunkStart']; }); $baseline = self::$report; try { foreach ($workers as $worker) { if ($terminationSignal !== null) { throw new \RuntimeException('Parallel scan interrupted by signal ' . $terminationSignal . '.'); } if (isset($worker['delta']) && is_array($worker['delta'])) { self::mergeWorkerDelta($worker['delta']); } } } catch (\Throwable $exception) { self::$report = $baseline; throw $exception; } } /** * Temporarily convert termination signals into orderly worker cleanup. * * @return array|null */ private static function installWorkerSignalHandlers(&$terminationSignal) { if (!self::isPhpFunctionAvailable('pcntl_signal') || !self::isPhpFunctionAvailable('pcntl_async_signals') || !self::isPhpFunctionAvailable('pcntl_signal_get_handler')) { return null; } $state = ['async' => pcntl_async_signals(), 'handlers' => []]; foreach ([SIGINT, SIGTERM] as $signal) { $state['handlers'][$signal] = pcntl_signal_get_handler($signal); pcntl_signal($signal, static function ($receivedSignal) use (&$terminationSignal) { $terminationSignal = $receivedSignal; }); } pcntl_async_signals(true); return $state; } private static function restoreWorkerSignalHandlers($state) { if (!is_array($state)) { return; } foreach ($state['handlers'] as $signal => $handler) { pcntl_signal($signal, $handler); } pcntl_async_signals($state['async']); } private static function resetWorkerSignalHandlers() { if (!self::isPhpFunctionAvailable('pcntl_signal')) { return; } pcntl_signal(SIGINT, SIG_DFL); pcntl_signal(SIGTERM, SIG_DFL); } private static function wasWaitInterrupted() { return defined('PCNTL_EINTR') && self::isPhpFunctionAvailable('pcntl_get_last_error') && pcntl_get_last_error() === PCNTL_EINTR; } private static function stopWorkerChunks(array $workers) { foreach ($workers as $worker) { if (!empty($worker['done']) || $worker['pid'] === null) { continue; } if (is_string($worker['statusFile'])) { @file_put_contents($worker['statusFile'] . '.cancel', '1', LOCK_EX); } if (self::isPhpFunctionAvailable('posix_kill')) { @posix_kill($worker['pid'], SIGTERM); } } foreach ($workers as $worker) { if (empty($worker['done']) && $worker['pid'] !== null) { do { $waited = @pcntl_waitpid($worker['pid'], $status); } while ($waited === -1 && self::wasWaitInterrupted()); } if (is_string($worker['resultFile'])) { @unlink($worker['resultFile']); } if (is_string($worker['statusFile'])) { @unlink($worker['statusFile']); @unlink($worker['statusFile'] . '.cancel'); } } } /** * Fork a worker process that scans one contiguous chunk of files. * * In the parent this returns the worker pid and its result file. When the * chunk could not be forked (temp file creation or fork failure) the chunk * is executed inline and returned as an already computed partial report. */ private function startWorkerChunk(array $items, $chunkStart, $chunkEnd) { $chunkTotal = $chunkEnd - $chunkStart; $chunkBytes = 0; for ($index = $chunkStart; $index < $chunkEnd; $index++) { $chunkBytes += $this->workerCandidateScanBytes($items[$index]); } $inline = function () use ($items, $chunkStart, $chunkEnd) { return $this->runWorkerChunkInline($items, $chunkStart, $chunkEnd); }; $resultFile = tempnam(sys_get_temp_dir(), 'amwscan-par-'); if ($resultFile === false) { return ['pid' => null, 'resultFile' => null, 'statusFile' => null, 'chunkStart' => $chunkStart, 'chunkEnd' => $chunkEnd, 'chunkTotal' => $chunkTotal, 'chunkBytes' => $chunkBytes, 'result' => $inline()]; } $statusFile = $resultFile . '.progress'; $pid = @pcntl_fork(); if ($pid === -1) { @unlink($resultFile); return ['pid' => null, 'resultFile' => null, 'statusFile' => null, 'chunkStart' => $chunkStart, 'chunkEnd' => $chunkEnd, 'chunkTotal' => $chunkTotal, 'chunkBytes' => $chunkBytes, 'result' => $inline()]; } if ($pid === 0) { self::resetWorkerSignalHandlers(); // Worker child: never compete with interactive/system processes for // the CPU, so drop to the lowest priority before scanning. self::applyWorkerPriority(); // Worker child: scan the assigned chunk and persist the partial report. try { try { $baseline = self::$report; $processed = 0; $processedBytes = 0; $lastStatusWrite = 0.0; for ($index = $chunkStart; $index < $chunkEnd; $index++) { if (self::isWorkerCancellationRequested($statusFile)) { break; } try { $processedBytes += $this->scanWorkerItem($items[$index]); } catch (\Throwable $exception) { self::recordScanWorkerError($exception, $items[$index]->getPathname()); } $processed++; $flagged = isset(self::$report['detected']) ? (int)self::$report['detected'] : 0; $now = microtime(true); if (!$this->isWorkerCancellationRequested($statusFile) && (($processed % 10) === 0 || ($now - $lastStatusWrite) >= 1.0)) { @file_put_contents($statusFile, $processed . ' ' . $processedBytes . ' ' . $flagged, LOCK_EX); $lastStatusWrite = $now; } } $flagged = isset(self::$report['detected']) ? (int)self::$report['detected'] : 0; @file_put_contents($statusFile, $processed . ' ' . $processedBytes . ' ' . $flagged, LOCK_EX); $payload = serialize(self::scanWorkerDelta($baseline)); } catch (\Throwable $exception) { $payload = serialize(['fatal' => $exception->getMessage()]); } @file_put_contents($resultFile, $payload, LOCK_EX); } catch (\Throwable $exception) { @file_put_contents($resultFile, serialize(['fatal' => $exception->getMessage()]), LOCK_EX); } @unlink($statusFile); exit(0); } return ['pid' => $pid, 'resultFile' => $resultFile, 'statusFile' => $statusFile, 'chunkStart' => $chunkStart, 'chunkEnd' => $chunkEnd, 'chunkTotal' => $chunkTotal, 'chunkBytes' => $chunkBytes, 'result' => null]; } /** * Estimated scan payload (bytes) of a candidate file, used only for * progress/ETA bookkeeping. Skipped files contribute zero bytes. * * @return int */ private function workerCandidateScanBytes(\SplFileInfo $info) { $fileSize = @filesize($info->getPathname()); if ($fileSize === false) { $fileSize = 0; } return $this->isFileScanCandidate($info, $fileSize) ? (int)$fileSize : 0; } private static function isWorkerCancellationRequested($statusFile) { return is_string($statusFile) && is_file($statusFile . '.cancel'); } /** * Read the progress a running worker has already published. * * @return array [processedFiles, processedBytes, flaggedFiles] */ private static function readWorkerProgress($statusFile) { if (!is_string($statusFile) || !is_file($statusFile)) { return [0, 0, 0]; } $raw = @file_get_contents($statusFile); if (!is_string($raw)) { return [0, 0, 0]; } $parts = explode(' ', trim($raw)); $files = isset($parts[0]) && ctype_digit($parts[0]) ? (int)$parts[0] : 0; $bytes = isset($parts[1]) && ctype_digit($parts[1]) ? (int)$parts[1] : 0; $flagged = isset($parts[2]) && ctype_digit($parts[2]) ? (int)$parts[2] : 0; return [$files, $bytes, $flagged]; } /** * Estimate how many seconds remain for the parallel scan. * * Scan time has both a fixed per-file component (deobfuscation, whitespace * stripping, per-function loops) and a component proportional to content * size. When the average candidate is small the fixed cost dominates, so * a file-based rate is more reliable; for large files a byte-based rate * is used. The heuristic picks the model that matches the average size. * * @return int|null */ private static function estimateRemainingSeconds($processedFiles, $processedBytes, $totalFiles, $totalBytes, $elapsed) { $elapsed = max(1, (int)$elapsed); $etaByFiles = null; if ($totalFiles > 0 && $processedFiles > 0) { $etaByFiles = (int)ceil(max(0, $totalFiles - $processedFiles) / ($processedFiles / $elapsed)); } $etaByBytes = null; if ($totalBytes > 0 && $processedBytes > 0) { $etaByBytes = (int)ceil(max(0, $totalBytes - $processedBytes) / ($processedBytes / $elapsed)); } if ($etaByFiles === null && $etaByBytes === null) { return null; } if ($etaByBytes !== null && $etaByFiles !== null && $totalFiles > 0) { // Roughly 64 KiB or more of content per file: time scales with bytes. if ($totalBytes / $totalFiles >= 65536) { return $etaByBytes; } return $etaByFiles; } return $etaByBytes !== null ? $etaByBytes : $etaByFiles; } /** * Write one parallel scan progress/ETA update. */ private static function writeParallelProgress( $processedFiles, $processedBytes, $totalFiles, $totalBytes, $eta, $flagged, $doneWorkers, $totalWorkers, $elapsed, $completed ) { CLI::writeLine( $processedFiles . '/' . $totalFiles . ' files · ' . self::parallelPercent($processedFiles, $processedBytes, $totalFiles, $totalBytes, $completed) . '% · ' . self::formatBytesHuman($processedBytes) . ' / ' . self::formatBytesHuman($totalBytes) . ' · ETA ' . ($eta === null ? 'unknown' : self::formatClock($eta)) . ' · ' . $flagged . ' flagged' . ' · ' . $doneWorkers . '/' . $totalWorkers . ' workers done · ' . $elapsed . 's elapsed', 1, 'grey' ); } /** * Completion percentage of the parallel scan (byte based when possible). * * @return int */ private static function parallelPercent($processedFiles, $processedBytes, $totalFiles, $totalBytes, $completed = false) { if ($completed) { return 100; } if ($totalBytes > 0) { return min(99, (int)round(min(1.0, $processedBytes / $totalBytes) * 100)); } if ($totalFiles > 0) { return min(99, (int)round(min(1.0, $processedFiles / $totalFiles) * 100)); } return 0; } /** * Human readable byte count. * * @return string */ private static function formatBytesHuman($bytes) { $bytes = (float)max(0, $bytes); if ($bytes >= 1073741824) { return number_format($bytes / 1073741824, 1) . ' GB'; } if ($bytes >= 1048576) { return number_format($bytes / 1048576, 1) . ' MB'; } if ($bytes >= 1024) { return number_format($bytes / 1024, 1) . ' KB'; } return (string)(int)$bytes . ' B'; } /** * Format a number of seconds as a clock value (M:SS or H:MM:SS). * * @return string */ private static function formatClock($seconds) { $seconds = max(0, (int)$seconds); $hours = intdiv($seconds, 3600); $minutes = intdiv($seconds % 3600, 60); $secs = $seconds % 60; return $hours > 0 ? sprintf('%d:%02d:%02d', $hours, $minutes, $secs) : sprintf('%d:%02d', $minutes, $secs); } /** * Read and clean up the partial report written by a finished worker. * * @return array|null */ private function collectWorkerChunk($resultFile, $statusFile = null) { $partial = null; if (is_file($resultFile)) { $raw = file_get_contents($resultFile); @unlink($resultFile); if (is_string($raw)) { $decoded = @unserialize($raw); if (is_array($decoded)) { $partial = $decoded; } } } if (is_string($statusFile) && is_file($statusFile)) { @unlink($statusFile); } if (!is_array($partial)) { if (!isset(self::$report['coverage']['errors'])) { self::$report['coverage']['errors'] = 0; } self::$report['coverage']['errors']++; self::$report['diagnostics'][] = 'A parallel worker finished without producing a result.'; return null; } if (isset($partial['fatal'])) { self::$report['coverage']['errors']++; self::$report['diagnostics'][] = 'Parallel worker failed: ' . $partial['fatal']; return null; } return $partial; } /** * Lower the niceness of the current worker process. * * Workers use the lowest CPU priority (niceness 19) by default so that a * scan never starves interactive or system processes. The AMWSCAN_WORKER_PRIORITY * environment variable can override this with a niceness in the -20..19 range. */ private static function applyWorkerPriority() { if (!self::isPhpFunctionAvailable('pcntl_setpriority')) { return; } $configured = getenv('AMWSCAN_WORKER_PRIORITY'); if ($configured === false || trim((string)$configured) === '' || !is_numeric($configured)) { $priority = self::WORKER_DEFAULT_PRIORITY; } else { $priority = max(-20, min(19, (int)$configured)); } if (self::isPhpFunctionAvailable('posix_getpid')) { $pid = posix_getpid(); } elseif (self::isPhpFunctionAvailable('getmypid')) { $pid = getmypid(); } else { $pid = 0; } if (!is_int($pid)) { $pid = 0; } if (defined('PRIO_PROCESS')) { @pcntl_setpriority($priority, $pid, PRIO_PROCESS); } else { @pcntl_setpriority($priority, $pid); } } /** * Fallback that scans a chunk in the current process and returns the * produced partial report without touching the shared report state. */ private function runWorkerChunkInline(array $items, $chunkStart, $chunkEnd) { $baseline = self::$report; for ($index = $chunkStart; $index < $chunkEnd; $index++) { try { $this->scanWorkerItem($items[$index]); } catch (\Throwable $exception) { self::recordScanWorkerError($exception, $items[$index]->getPathname()); } } $delta = self::scanWorkerDelta($baseline); self::$report = $baseline; return $delta; } /** * Scan one file exactly like the report-only branch of the sequential * scan loop. Interactive prompts and file remediation never run here, so * each worker touches only its own slice of the candidate file list. */ /** * Decide whether a candidate file is actually scanned (vs skipped cheaply). * * @return bool */ private function isFileScanCandidate(\SplFileInfo $info, $fileSize) { $fileExtension = strtolower($info->getExtension()); return ( (self::isScanAll() || in_array($fileExtension, self::$extensions, true)) && (self::$maxFilesize < 1 || $fileSize <= self::$maxFilesize) && (!file_exists(self::$pathQuarantine) || strpos(realpath($info->getPathname()), realpath(self::$pathQuarantine)) === false) ) || self::isInfectedFavicon($info); } /** * Scan one file and return how many payload bytes it represents (0 when the * file was skipped without a content scan). The value is used to estimate * progress and the remaining time of parallel report-only runs. * * @return int */ private function scanWorkerItem(\SplFileInfo $info) { $filePath = $info->getPathname(); $fileSize = @filesize($filePath); if ($fileSize === false) { $fileSize = 0; } $isFavicon = self::isInfectedFavicon($info); $resultBytes = 0; if ($this->isFileScanCandidate($info, $fileSize)) { $resultBytes = (int)$fileSize; $patternFound = $this->scanFile($info); if (!empty($this->supplementalFindings)) { self::$report['findings'] = array_merge(self::$report['findings'], $this->supplementalFindings); } // Check whitelist $inWhitelist = Whitelist::countMatches( self::$whitelist, $filePath, $patternFound, self::isOnlyPathWhitelistMode(), self::getPathScan() ); self::$report['scanned']++; self::$report['coverage']['scanned'] = self::$report['scanned']; if (realpath($filePath) !== realpath(__FILE__) && ($isFavicon || !empty($patternFound)) && ($inWhitelist === 0 || $inWhitelist !== count($patternFound))) { self::$report['detected']++; self::$report['infectedFound'][$filePath] = $patternFound; self::addMalwareFindings($filePath, $patternFound, $isFavicon); $fileHash = hash_file('sha256', $filePath); if (is_string($fileHash)) { self::$report['fileHashes'][$filePath] = $fileHash; } // Scan mode only self::$report['ignored'][] = 'File: ' . $filePath . PHP_EOL . 'Exploits:' . PHP_EOL . ' => ' . implode(PHP_EOL . ' => ', array_column($patternFound, 'output')); } } else { self::$report['coverage']['skipped']++; if (self::$maxFilesize > 0 && $fileSize > self::$maxFilesize) { self::$report['coverage']['reasons']['oversized']++; } else { self::$report['coverage']['reasons']['excluded']++; } } return $resultBytes; } /** * Record a per-file worker error in the shared coverage counters. */ private static function recordScanWorkerError(\Throwable $exception, $filePath) { if (!isset(self::$report['coverage']['errors'])) { self::$report['coverage']['errors'] = 0; } if (!isset(self::$report['diagnostics'])) { self::$report['diagnostics'] = []; } self::$report['coverage']['errors']++; self::$report['diagnostics'][] = 'Scan of "' . $filePath . '" failed: ' . $exception->getMessage(); } /** * Compute the report changes produced by a worker compared with the report * state it inherited at fork time. Counters are emitted as deltas and the * additive findings are emitted as newly appended entries. */ private static function scanWorkerDelta(array $baseline) { $current = self::$report; $delta = []; foreach (['scanned', 'detected'] as $key) { $delta[$key] = max(0, ($current[$key] ?? 0) - ($baseline[$key] ?? 0)); } $delta['coverage'] = [ 'scanned' => $delta['scanned'], 'reasons' => [], ]; foreach (['cached', 'skipped', 'errors'] as $field) { $delta['coverage'][$field] = max( 0, (isset($current['coverage'][$field]) ? $current['coverage'][$field] : 0) - (isset($baseline['coverage'][$field]) ? $baseline['coverage'][$field] : 0) ); } $reasonKeys = array_merge( isset($baseline['coverage']['reasons']) && is_array($baseline['coverage']['reasons']) ? array_keys($baseline['coverage']['reasons']) : [], isset($current['coverage']['reasons']) && is_array($current['coverage']['reasons']) ? array_keys($current['coverage']['reasons']) : [] ); foreach (array_unique($reasonKeys) as $reason) { $delta['coverage']['reasons'][$reason] = max( 0, (isset($current['coverage']['reasons'][$reason]) ? $current['coverage']['reasons'][$reason] : 0) - (isset($baseline['coverage']['reasons'][$reason]) ? $baseline['coverage']['reasons'][$reason] : 0) ); } // Additive lists: only forward the entries appended since the fork. foreach (['findings', 'ignored', 'diagnostics'] as $key) { $added = []; $currentList = isset($current[$key]) && is_array($current[$key]) ? $current[$key] : []; $baselineCount = isset($baseline[$key]) && is_array($baseline[$key]) ? count($baseline[$key]) : 0; if ($baselineCount < count($currentList)) { $added = array_slice($currentList, $baselineCount); } $delta[$key] = $added; } // Additive maps keyed by path. foreach (['infectedFound', 'fileHashes'] as $key) { $added = []; $currentMap = isset($current[$key]) && is_array($current[$key]) ? $current[$key] : []; $baselineMap = isset($baseline[$key]) && is_array($baseline[$key]) ? $baseline[$key] : []; foreach ($currentMap as $mapKey => $mapValue) { if (!array_key_exists($mapKey, $baselineMap)) { $added[$mapKey] = $mapValue; } } $delta[$key] = $added; } return $delta; } /** * Merge a worker partial report into the shared report. */ private static function mergeWorkerDelta(array $delta) { foreach (['scanned', 'detected'] as $key) { if (isset($delta[$key])) { self::$report[$key] = (isset(self::$report[$key]) ? self::$report[$key] : 0) + $delta[$key]; } } if (isset($delta['coverage'])) { foreach (['scanned', 'cached', 'skipped', 'errors'] as $field) { if (isset($delta['coverage'][$field])) { self::$report['coverage'][$field] = (isset(self::$report['coverage'][$field]) ? self::$report['coverage'][$field] : 0) + $delta['coverage'][$field]; } } if (!empty($delta['coverage']['reasons'])) { foreach ($delta['coverage']['reasons'] as $reason => $count) { self::$report['coverage']['reasons'][$reason] = (isset(self::$report['coverage']['reasons'][$reason]) ? self::$report['coverage']['reasons'][$reason] : 0) + $count; } } } foreach (['findings', 'ignored', 'diagnostics', 'infectedFound', 'fileHashes'] as $key) { if (!empty($delta[$key])) { self::$report[$key] = array_merge( isset(self::$report[$key]) && is_array(self::$report[$key]) ? self::$report[$key] : [], $delta[$key] ); } } } /** * Configure the number of parallel worker processes. * * The value comes from the --jobs flag, the AMWSCAN_JOBS environment * variable, or defaults to a bounded worker count. */ private static function configureParallelJobs() { $value = getenv('AMWSCAN_JOBS'); if (self::$argv->wasProvided('jobs')) { $value = self::$argv['jobs']; } if ($value === false || $value === null || $value === '') { self::$settings['jobs'] = min(self::cpuCount(), self::PARALLEL_MAX_DEFAULT_JOBS); return; } $normalized = strtolower(trim((string)$value)); if ($normalized === 'auto' || $normalized === '0') { self::$settings['jobs'] = self::cpuCount(); return; } if (ctype_digit($normalized) && (int)$normalized >= 1) { self::$settings['jobs'] = (int)$normalized; return; } throw new \InvalidArgumentException('--jobs must be a positive integer, "auto", or 0.'); } /** * Detect the number of available CPU cores. * * @return int */ private static function cpuCount() { static $count = null; if ($count !== null) { return $count; } $count = 1; if (PHP_OS_FAMILY === 'Linux' && is_file('/proc/cpuinfo') && is_readable('/proc/cpuinfo')) { $cpuinfo = @file_get_contents('/proc/cpuinfo'); if (is_string($cpuinfo) && preg_match_all('/^processor\s*:/m', $cpuinfo, $matches) > 0) { $count = count($matches[0]); } } elseif (PHP_OS_FAMILY === 'Darwin' && function_exists('shell_exec')) { $cores = @shell_exec('/usr/sbin/sysctl -n hw.ncpu 2>/dev/null'); if (is_string($cores) && trim($cores) !== '' && ctype_digit(trim($cores))) { $count = (int)trim($cores); } } if (PHP_OS_FAMILY === 'Windows' && function_exists('shell_exec')) { $cores = @shell_exec('echo %NUMBER_OF_PROCESSORS%'); if (is_string($cores) && trim($cores) !== '' && ctype_digit(trim($cores))) { $count = (int)trim($cores); } } if ($count < 1) { $count = 1; } return $count; } private function saveFixedContent($filePath, &$fileContent, $fixedContent, $info, array &$patternFound, &$inLoop) { if (!$this->confirmFixedContents($filePath, $fileContent, $fixedContent)) { self::$report['ignored'][] = $filePath; self::$report['infectedFound'][$filePath] = $patternFound; if (self::$prompt !== null) { $inLoop = false; } return; } $fileContent = $fixedContent; if (Actions::putContents($filePath, $fileContent) === false) { CLI::writeLine("File '$filePath' could not be sanitized!", 2, 'red'); if (self::$prompt !== null) { self::$report['ignored'][] = $filePath; $inLoop = false; } return; } if ($this->rescanFixedFile($info, $patternFound)) { CLI::writeLine("File '$filePath' sanitized and verified!", 2, 'green'); self::$report['removed'][] = $filePath; $inLoop = false; return; } CLI::writeLine("File '$filePath' was saved, but malware is still detected.", 2, 'red'); if (self::$prompt !== null) { self::$report['ignored'][] = $filePath; $inLoop = false; } } private function confirmFixedContents($filePath, $originalContent, $fixedContent) { $diff = Diff::unifiedDiff($originalContent, $fixedContent, $filePath); if ($diff === '') { CLI::writeLine('The selected fix did not change the file.', 2, 'yellow'); return false; } CLI::displayLine('PROPOSED CHANGES:', 2); CLI::writeLine($diff, 2); $syntax = PhpLinter::validatePhpContents($filePath, $fixedContent); if ($syntax['checked']) { CLI::writeLine('PHP syntax check: ' . $syntax['message'], 2, $syntax['valid'] ? 'green' : 'red'); } if (!$syntax['valid']) { CLI::writeLine('The fix was not saved because the PHP syntax check failed.', 2, 'red'); return false; } $confirmation = 'y'; if (self::$prompt === null) { $confirmation = CLI::read('Confirm and save [y|N]? ', 'purple'); } CLI::newLine(); return strtolower($confirmation) === 'y'; } private function editAndVerifyFile($editor, $info, array &$patternFound, &$inLoop) { $filePath = $info->getPathname(); $firstLineNumber = null; foreach ($patternFound as $pattern) { if (!empty($pattern['line']) && is_numeric($pattern['line'])) { $firstLineNumber = $pattern['line']; break; } } try { $result = $editor === 'vim' ? Editor::openWithVim($filePath, $firstLineNumber) : Editor::openWithNano($filePath, $firstLineNumber); } catch (\Throwable $exception) { CLI::writeLine('Unable to edit the file: ' . $exception->getMessage(), 2, 'red'); return; } if (!$result['changed']) { CLI::writeLine("File '$filePath' was not changed.", 2, 'yellow'); return; } self::$report['edited'][] = $filePath; CLI::displayLine('CHANGES MADE:', 2); CLI::writeLine($result['diff'], 2); $editedContent = file_get_contents($filePath); if (!is_string($editedContent)) { CLI::writeLine("File '$filePath' could not be read after editing.", 2, 'red'); return; } $syntax = PhpLinter::validatePhpContents($filePath, $editedContent); if ($syntax['checked']) { CLI::writeLine('PHP syntax check: ' . $syntax['message'], 2, $syntax['valid'] ? 'green' : 'red'); } if (!$syntax['valid']) { CLI::writeLine('The edited file has PHP syntax errors and remains unresolved.', 2, 'red'); return; } if (!$this->rescanFixedFile($info, $patternFound)) { CLI::writeLine("File '$filePath' still contains detected malware.", 2, 'red'); return; } CLI::writeLine("No malware was detected after editing '$filePath'.", 1, 'green'); $markCleaned = CLI::read('Mark file as cleaned [y|N]? ', 'purple'); CLI::newLine(); if (strtolower($markCleaned) === 'y') { self::$report['removed'][] = $filePath; } else { self::$report['ignored'][] = $filePath; } $inLoop = false; } private function rescanFixedFile($info, array &$patternFound) { $filePath = $info->getPathname(); $patternFound = $this->scanFile($info); $hash = hash_file('sha256', $filePath); if (is_string($hash)) { self::$report['fileHashes'][$filePath] = $hash; } $isFavicon = self::isInfectedFavicon($info); if ($isFavicon || !empty($patternFound)) { self::$report['infectedFound'][$filePath] = $patternFound; return false; } return true; } private static function candidateManifestHash(array $items) { $manifest = []; foreach ($items as $item) { self::touchScanHeartbeat(); $path = $item->getPathname(); $stat = is_file($path) ? @stat($path) : false; $manifest[] = [ str_replace('\\', '/', $path), is_array($stat) ? (int)$stat['size'] : null, is_array($stat) ? (int)$stat['mtime'] : null, is_array($stat) ? (int)$stat['ctime'] : null, is_array($stat) ? (int)$stat['ino'] : null, ]; } return hash('sha256', serialize($manifest)); } private static function saveScanCheckpoint( $store, $manifestHash, $configurationHash, $nextIndex, $total, $startedAt, $force = false, $progressCurrent = null, $completedChunks = null ) { if ($store === null) { return; } $now = microtime(true); $filesSinceWrite = self::$lastCheckpointIndex === null ? self::CHECKPOINT_FILE_INTERVAL : $nextIndex - self::$lastCheckpointIndex; if (!$force && $filesSinceWrite < self::CHECKPOINT_FILE_INTERVAL && $now - self::$lastCheckpointWrite < self::CHECKPOINT_TIME_INTERVAL) { return; } $current = $progressCurrent === null ? $nextIndex : $progressCurrent; $progress = [ 'current' => min($total, max(0, (int)$current)), 'total' => $total, 'started_at' => $startedAt, 'phase' => 'scanning', ]; if ($completedChunks === null && is_array(self::$checkpointCompletedChunks)) { $completedChunks = self::$checkpointCompletedChunks; } if ($completedChunks === null) { $store->save($manifestHash, $configurationHash, $nextIndex, self::$report, $progress); } else { $store->save($manifestHash, $configurationHash, $nextIndex, self::$report, $progress, $completedChunks); } self::$lastCheckpointIndex = $nextIndex; self::$lastCheckpointWrite = $now; } private static function checkpointConfigurationHash() { return hash('sha256', serialize([ 'scan-cache' => self::getScanCacheFingerprint(), 'path' => self::$pathScan, 'extensions' => self::$extensions, 'scan-all' => self::isScanAll(), 'scan-archives' => !empty(self::$settings['scan-archives']), 'scan-wordpress-db' => !empty(self::$settings['scan-wordpress-db']), 'wordpress-admin-threshold' => self::$settings['wordpress-admin-threshold'] ?? Database::MAX_NORMAL_ADMINISTRATOR_THRESHOLD, 'scan-domains' => self::shouldScanDomains(), 'domain-analysis-scope' => isset(self::$settings['domain-analysis-scope']) ? self::$settings['domain-analysis-scope'] : 'all', 'ai-provider' => isset(self::$settings['ai-provider']) ? self::$settings['ai-provider'] : 'disabled', 'ai-model' => isset(self::$settings['ai-model']) ? self::$settings['ai-model'] : null, 'ai-context-lines' => isset(self::$settings['ai-context-lines']) ? self::$settings['ai-context-lines'] : 5, 'ai-max-findings' => isset(self::$settings['ai-max-findings']) ? self::$settings['ai-max-findings'] : 20, 'max-filesize' => self::$maxFilesize, 'selected-paths' => self::normalizedScanPathFilters(), 'ignore-paths' => self::$ignorePaths, 'filter-paths' => self::$filterPaths, 'whitelist' => hash('sha256', json_encode(self::$whitelist, JSON_UNESCAPED_SLASHES)), 'whitelist-only-path' => self::isOnlyPathWhitelistMode(), ])); } private static function normalizedScanPathFilters() { $paths = array_map(static function ($path) { $path = rtrim(str_replace('\\', '/', (string)$path), '/'); return DIRECTORY_SEPARATOR === '\\' ? strtolower($path) : $path; }, self::$scanPathFilters); $paths = array_values(array_unique($paths)); sort($paths, SORT_STRING); return $paths; } private function scanArchiveFile($info) { $archivePath = $info->getPathname(); try { $result = (new ArchiveScanner())->scan($archivePath, function ($content, $virtualPath) { return $this->scanArchiveEntry($content, $virtualPath); }); self::$report['coverage']['archives'] = isset(self::$report['coverage']['archives']) ? self::mergeArchiveCoverage(self::$report['coverage']['archives'], $result['coverage']) : $result['coverage']; self::$report['findings'] = array_merge(self::$report['findings'], $result['findings']); $legacy = []; foreach ($result['findings'] as $finding) { if (!isset($finding['kind']) || $finding['kind'] !== 'malware') { continue; } $legacy[] = [ 'type' => 'archive', 'key' => $finding['rule_id'], 'level' => $finding['severity'], 'output' => $finding['message'], 'description' => $finding['message'], 'line' => isset($finding['evidence']['line']) ? $finding['evidence']['line'] : null, 'pattern' => '', 'match' => $finding['subject'], ]; } if (!empty($legacy)) { self::$report['detected']++; self::$report['infectedFound'][$archivePath] = $legacy; $hash = hash_file('sha256', $archivePath); if (is_string($hash)) { self::$report['fileHashes'][$archivePath] = $hash; } } } catch (\Throwable $exception) { self::$report['coverage']['reasons']['archive_limit']++; self::$report['diagnostics'][] = 'Archive scan skipped for "' . $archivePath . '": ' . $exception->getMessage(); } } private function scanArchiveEntry($content, $virtualPath) { $extension = strtolower(pathinfo($virtualPath, PATHINFO_EXTENSION)); $temporary = sys_get_temp_dir() . DIRECTORY_SEPARATOR . 'amwscan-entry-' . bin2hex(random_bytes(8)) . ($extension === '' ? '' : '.' . preg_replace('/[^a-z0-9]/', '', $extension)); AtomicFile::replaceContentsAtomically($temporary, $content, false); $cacheEnabled = self::isCacheEnabled(); self::disableCache(); try { $patterns = $this->scanFile(new \SplFileInfo($temporary)); } finally { if ($cacheEnabled) { self::enableCache(); } @unlink($temporary); } $findings = []; foreach ($patterns as $pattern) { $findings[] = Finding::create( 'malware', $virtualPath, (isset($pattern['type']) ? $pattern['type'] : 'pattern') . ':' . $pattern['key'], isset($pattern['level']) ? $pattern['level'] : 'warn', isset($pattern['description']) ? $pattern['description'] : 'A suspicious pattern was detected in an archive.', [ 'line' => isset($pattern['line']) ? $pattern['line'] : null, 'match' => isset($pattern['match']) ? $pattern['match'] : '', 'content_hash' => hash('sha256', $content), ], isset($pattern['provider']) ? $pattern['provider'] : 'builtin' ); } if (self::shouldScanDomainsForPath($virtualPath)) { $findings = array_merge($findings, $this->scanDomains($content, $virtualPath)); } return $findings; } private static function mergeArchiveCoverage(array $left, array $right) { foreach (['discovered', 'scanned', 'skipped'] as $field) { $left[$field] = (isset($left[$field]) ? $left[$field] : 0) + (isset($right[$field]) ? $right[$field] : 0); } foreach (isset($right['reasons']) ? $right['reasons'] : [] as $reason => $count) { $left['reasons'][$reason] = (isset($left['reasons'][$reason]) ? $left['reasons'][$reason] : 0) + $count; } $leftComplete = !isset($left['complete']) || $left['complete'] === true; $rightComplete = !isset($right['complete']) || $right['complete'] === true; $left['complete'] = $leftComplete && $rightComplete; return $left; } /** * Print summary. */ private function summary() { if (!empty(self::$settings['offset'])) { $offset = (int)self::$settings['offset']; self::$report['scanned'] = max(0, self::$report['scanned'] - $offset); self::$report['coverage']['scanned'] = max(0, self::$report['coverage']['scanned'] - $offset); } // Statistics CLI::displayTitle('SUMMARY', 'black', 'cyan'); CLI::writeBreak(); CLI::writeLine('Files scanned: ' . self::$report['scanned']); if (self::$report['verifiedByChecksum'] > 0) { CLI::writeLine('Files verified by checksum: ' . self::$report['verifiedByChecksum'], 2); } if (!self::isReportMode()) { self::$report['ignored'] = array_unique(self::$report['ignored']); self::$report['edited'] = array_unique(self::$report['edited']); CLI::writeLine('Files edited: ' . count(self::$report['edited'])); CLI::writeLine('Files quarantined: ' . count(self::$report['quarantine'])); CLI::writeLine('Files whitelisted: ' . count(self::$report['whitelist'])); CLI::writeLine('Files ignored: ' . count(self::$report['ignored']), 2); } $malwareSummary = 'Malware detected: ' . self::$report['detected']; if (!empty(self::$report['ai_review'])) { $malwareSummary .= sprintf( ' | AI reviewed: %d (%s)', self::$report['ai_review']['reviewed'], self::$report['ai_review']['provider'] ); } CLI::writeLine($malwareSummary); if (!empty(self::$report['ai_review'])) { foreach (self::$report['infectedFound'] as $filePath => $patterns) { foreach ($patterns as $pattern) { if (empty($pattern['ai_review']) || !is_array($pattern['ai_review'])) { continue; } $review = $pattern['ai_review']; $completed = !isset($review['status']) || $review['status'] === 'completed'; $label = $completed && isset($review['verdict']) ? $review['verdict'] : (isset($review['status']) ? $review['status'] : 'failed'); $message = $completed && isset($review['reason']) ? $review['reason'] : (isset($review['message']) ? $review['message'] : 'AI review failed.'); $confidence = $completed && isset($review['confidence']) ? sprintf(' (%d%%)', (int)round($review['confidence'] * 100)) : ''; CLI::writeLine(sprintf( ' - %s [%s:%s] | AI: %s%s - %s', $filePath, isset($pattern['type']) ? $pattern['type'] : 'pattern', isset($pattern['key']) ? $pattern['key'] : '', strtoupper(str_replace('_', ' ', $label)), $confidence, $message )); } } } if (!self::isReportMode()) { CLI::writeLine('Malware removed: ' . count(self::$report['removed'])); } $this->displayPluginIntegrityIssues(); if (self::isReportEnabled()) { $report = new Report(); $format = self::$reportFormat; if (in_array(self::$reportFormat, ['html', 'htm', 'txt', 'text', 'log', 'logs'])) { $report->setData([ 'scanned' => self::$report['scanned'], 'results' => self::$report['infectedFound'], 'verifiedByChecksum' => self::$report['verifiedByChecksum'], 'findings' => isset(self::$report['findings']) ? self::$report['findings'] : [], 'wordpressDatabase' => isset(self::$report['wordpress_db']) ? self::$report['wordpress_db'] : [], 'inventory' => self::$report['inventory'] ?? [], ]); } else { $report->setData(['report' => self::$report]); } $output = $report->save(self::$pathReport, $format); if (self::isReportMode()) { CLI::writeLine(CLI::eol(1) . "Report saved to '" . $output . "'", 1, 'red'); CLI::writeBreak(2); } } if (!self::isReportMode()) { if (count(self::$report['removed']) > 0) { CLI::writeBreak(); CLI::writeLine('Files removed:', 1, 'red'); foreach (self::$report['removed'] as $un) { CLI::writeLine($un); } } if (count(self::$report['edited']) > 0) { CLI::writeBreak(); CLI::writeLine('Files edited:', 1, 'green'); foreach (self::$report['edited'] as $un) { CLI::writeLine($un); } } if (count(self::$report['quarantine']) > 0) { CLI::writeBreak(); CLI::writeLine('Files quarantined:', 1, 'yellow'); foreach (self::$report['quarantine'] as $un) { CLI::writeLine($un); } } if (count(self::$report['whitelist']) > 0) { CLI::writeBreak(); CLI::writeLine('Files whitelisted:', 1, 'cyan'); foreach (self::$report['whitelist'] as $un) { CLI::writeLine($un); } } if (count(self::$report['ignored']) > 0) { CLI::writeBreak(); CLI::writeLine('Files ignored:', 1, 'cyan'); foreach (self::$report['ignored'] as $un) { CLI::writeLine($un); } } CLI::writeBreak(2); } } private function displayPluginIntegrityIssues() { foreach (self::$report['findings'] as $finding) { if (!is_array($finding) || !isset($finding['kind'], $finding['rule_id'], $finding['subject']) || $finding['kind'] !== 'integrity' || $finding['rule_id'] !== 'integrity:plugin') { continue; } $issues = isset($finding['evidence']['issues']) && is_array($finding['evidence']['issues']) ? $finding['evidence']['issues'] : []; CLI::writeLine('Plugin integrity warning: ' . $finding['subject'] . ' (' . count($issues) . ' affected files)', 2, 'yellow'); foreach ($issues as $issue) { if (!is_array($issue) || empty($issue['path'])) { continue; } $status = isset($issue['status']) ? strtoupper($issue['status']) : 'UNKNOWN'; CLI::writeLine(' - [' . $status . '] ' . $issue['path']); } } } /** * Update to last version. */ public function update() { if (!self::isCli()) { return; } CLI::writeLine('Checking update...'); $version = file_get_contents(self::getLatestVersionUrl()); if (!empty($version)) { if (version_compare(self::$version, $version, '<')) { CLI::write('New version'); CLI::write(' ' . $version . ' '); CLI::writeLine('of the scanner available!', 2); $confirm = CLI::read('You sure you want update the index.php to the last version [y|N]? ', 'purple'); CLI::writeBreak(); if (strtolower($confirm) === 'y') { $newVersion = file_get_contents(self::getLatestReleaseUrl()); file_put_contents(Path::getCurrent(), $newVersion); CLI::write('Updated to last version'); CLI::write(' (' . self::$version . ' => ' . $version . ') '); CLI::writeLine('with SUCCESS!', 2); } else { CLI::writeLine('Updated SKIPPED!', 2); } } else { CLI::writeLine('You have the last version of the index.php yet!', 2); } } else { CLI::writeLine('Update FAILED!', 2, 'red'); } } /** * Is console instance. * * @return bool */ public static function isCli() { return defined('STDIN') || php_sapi_name() === 'cli' || ( empty($_SERVER['REMOTE_ADDR']) && !isset($_SERVER['HTTP_USER_AGENT']) && count($_SERVER['argv']) > 0 ); } /** * Interrupt. */ protected function interrupt() { $this->interrupt = true; if (self::isCli()) { exit; } } /** * @return bool */ public static function isLogEnabled() { return isset(self::$settings['log']) ? self::$settings['log'] : false; } /** * @return self */ public static function enableLogs() { self::$settings['log'] = true; return new self(); } /** * @return self */ public static function disableLogs() { self::$settings['log'] = false; return new self(); } /** * @param int $offset * * @return self */ public static function setOffset($offset) { self::$settings['offset'] = $offset; return new self(); } /** * @param int $limit * * @return self */ public static function setLimit($limit) { self::$settings['limit'] = $limit; return new self(); } /** * @param bool $mode * * @return self */ public static function setSilentMode($mode = true) { self::$settings['silent'] = $mode; if ($mode) { if (self::$prompt === null) { self::setAutoSkip(); } } return new self(); } /** * @return bool */ public static function isSilentMode() { return isset(self::$settings['silent']) ? self::$settings['silent'] : false; } /** * @param bool $mode * * @return self */ public static function setVerifier($mode = true) { self::$settings['verifier'] = $mode; return new self(); } /** * @return bool */ public static function isVerifierEnabled() { return isset(self::$settings['verifier']) ? self::$settings['verifier'] : true; } /** * @param bool $mode * * @return self */ public static function setColors($mode = true) { self::$settings['colors'] = $mode; return new self(); } /** * @return bool */ public static function isColorEnabled() { return isset(self::$settings['colors']) ? self::$settings['colors'] : true; } /** * @return bool */ public static function isCacheEnabled() { return isset(self::$settings['cache']) ? self::$settings['cache'] : true; } /** * @param bool $mode * * @return self */ public static function setDeobfuscateMode($mode = true) { self::$settings['deobfuscate-mode'] = $mode; self::enableReport(); return new self(); } /** * @return bool */ public static function isDeobfuscateMode() { return isset(self::$settings['deobfuscate-mode']) ? self::$settings['deobfuscate-mode'] : false; } /** * @return self */ public static function enableDeobfuscateMode() { self::setDeobfuscateMode(); return new self(); } /** * @return self */ public static function enableChecksum() { self::setVerifier(); return new self(); } /** * @return self */ public static function disableChecksum() { self::setVerifier(false); return new self(); } /** * @return self */ public static function enableCache() { self::$settings['cache'] = true; return new self(); } /** * @return self */ public static function disableCache() { self::$settings['cache'] = false; return new self(); } /** * @return self */ public static function disableDeobfuscateMode() { self::setDeobfuscateMode(false); return new self(); } /** * @param bool $mode * * @return self */ public static function setOnlyFunctionsMode($mode = true) { self::$settings['only-functions'] = $mode; self::$settings['scan-exploits'] = false; self::$settings['scan-functions'] = true; self::$settings['scan-signatures'] = true; self::$scanCacheFingerprint = null; return new self(); } /** * @return bool */ public static function isOnlyFunctionsMode() { return isset(self::$settings['only-functions']) ? self::$settings['only-functions'] : false; } /** * @param bool $mode * * @return self */ public static function setOnlyExploitsMode($mode = true) { self::$settings['only-exploits'] = $mode; self::$settings['scan-exploits'] = true; self::$settings['scan-functions'] = false; self::$settings['scan-signatures'] = false; self::$scanCacheFingerprint = null; return new self(); } /** * @return bool */ public static function isOnlyExploitsMode() { return isset(self::$settings['only-exploits']) ? self::$settings['only-exploits'] : false; } /** * @param bool $mode * * @return self */ public static function setOnlySignaturesMode($mode = true) { self::$settings['only-signatures'] = $mode; self::$settings['scan-exploits'] = false; self::$settings['scan-functions'] = false; self::$settings['scan-signatures'] = true; self::$scanCacheFingerprint = null; return new self(); } /** * @return bool */ public static function isOnlySignaturesMode() { return isset(self::$settings['only-signatures']) ? self::$settings['only-signatures'] : false; } /** * @return self */ public static function enableLiteMode() { self::setLiteMode(); return new self(); } /** * @return self */ public static function disableLiteMode() { self::setLiteMode(false); return new self(); } /** * @param bool $mode * * @return self */ protected static function setLiteMode($mode = true) { self::$settings['lite'] = $mode; if ($mode) { self::$settings['exploits'] = true; self::$exploits = Exploits::getLite(); } else { self::$exploits = Exploits::getAll(); } self::$scanCacheFingerprint = null; return new self(); } /** * @return bool */ public static function isLiteMode() { return isset(self::$settings['lite']) ? self::$settings['lite'] : false; } /** * @return self */ public static function setReportMode($mode = true) { self::$settings['report-mode'] = $mode; return new self(); } /** * @return bool */ public static function isReportMode() { return isset(self::$settings['report-mode']) ? self::$settings['report-mode'] : false; } /** * @return self */ public static function enableReportMode() { self::setReportMode(); return new self(); } /** * @return self */ public static function disableReportMode() { self::setReportMode(false); return new self(); } /** * @param bool $mode * * @return self */ protected static function setReport($mode = true) { self::$settings['report'] = $mode; return new self(); } /** * @return self */ public static function enableReport() { self::setReport(); return new self(); } /** * @return self */ public static function disableReport() { self::setReport(false); return new self(); } /** * @return bool */ public static function isReportEnabled() { return isset(self::$settings['report']) ? self::$settings['report'] : true; } /** * @return self */ public static function enableBackups() { self::$settings['backup'] = true; return new self(); } /** * @return self */ public static function disableBackups() { self::$settings['backup'] = false; return new self(); } /** * @return bool */ public static function isBackupEnabled() { return !empty(self::$settings['backup']); } /** * @param bool $mode * * @return self */ public static function setOnlyPathWhitelistMode($mode = true) { self::$settings['whitelist-only-path'] = $mode; return new self(); } /** * @return bool */ public static function isOnlyPathWhitelistMode() { return isset(self::$settings['whitelist-only-path']) ? self::$settings['whitelist-only-path'] : false; } /** * @return array */ public static function getIgnorePaths() { return self::$ignorePaths; } /** * @param array $ignorePaths * * @return self */ public static function setIgnorePaths($ignorePaths) { self::$ignorePaths = $ignorePaths; return new self(); } /** * @return array */ public static function getFilterPaths() { return self::$filterPaths; } /** * @param array $filterPaths * * @return self */ public static function setFilterPaths($filterPaths) { self::$filterPaths = $filterPaths; return new self(); } /** * @return string */ public static function getPrompt() { return self::$prompt; } /** * @param string $prompt * * @return self */ public static function setPrompt($prompt) { self::$prompt = $prompt; return new self(); } /** * @param string $mode * * @return self */ public static function setAutoDelete($mode = true) { self::setPrompt($mode !== '' ? 'delete' : null); return new self(); } /** * @param string $mode * * @return self */ public static function setAutoClean($mode = true) { self::setPrompt($mode !== '' ? 'clean' : null); return new self(); } /** * @param string $mode * * @return self */ public static function setAutoCleanLine($mode = true) { self::setPrompt($mode !== '' ? 'clean-line' : null); return new self(); } /** * @param string $mode * * @return self */ public static function setAutoQuarantine($mode = true) { self::setPrompt($mode !== '' ? 'quarantine' : null); return new self(); } /** * @param string $mode * * @return self */ public static function setAutoWhitelist($mode = true) { self::setPrompt($mode !== '' ? 'whitelist' : null); return new self(); } /** * @param string $mode * * @return self */ public static function setAutoSkip($mode = true) { self::setPrompt($mode !== '' ? 'skip' : null); return new self(); } /** * @return string */ public static function getPathBackups() { return self::$pathBackups; } /** * @param string $pathBackups * * @return self */ public static function setPathBackups($pathBackups) { self::$pathBackups = Path::get($pathBackups); return new self(); } /** * @return string */ public static function getPathDeobfuscate() { return self::$pathDeobfuscate; } /** * @param string $pathDeobfuscate * * @return self */ public static function setPathDeobfuscate($pathDeobfuscate) { self::$pathDeobfuscate = Path::get($pathDeobfuscate); return new self(); } /** * @return string */ public static function getPathQuarantine() { return self::$pathQuarantine; } /** * @param string $pathQuarantine * * @return self */ public static function setPathQuarantine($pathQuarantine) { self::$pathQuarantine = Path::get($pathQuarantine); return new self(); } /** * @return string */ public static function getPathLogs() { return self::$pathLogs; } /** * @param string $pathLogs * * @return self */ public static function setPathLogs($pathLogs) { self::$pathLogs = Path::get($pathLogs); return new self(); } /** * @return string */ public static function getPathReport() { return self::$pathReport; } /** * @param string $pathReport * * @return self */ public static function setPathReport($pathReport) { self::$pathReport = Path::get($pathReport); return new self(); } /** * @param string $reportFormat * * @return self */ public static function setReportFormat($reportFormat) { if (in_array($reportFormat, ['txt', 'text', 'log', 'logs', 'html', 'htm', 'json', 'sarif'])) { self::$reportFormat = $reportFormat; } return new self(); } /** * @return string */ public static function getPathWhitelist() { return self::$pathWhitelist; } /** * @param string $pathWhitelist * * @return self */ public static function setPathWhitelist($pathWhitelist) { self::$pathWhitelist = Path::get($pathWhitelist); return new self(); } /** * @return string */ public static function getPathScan() { return self::$pathScan; } /** * @param string $pathScan * * @return self */ public static function setPathScan($pathScan) { self::$pathScan = Path::get($pathScan); self::$scanPathFilters = []; return new self(); } protected static function setExpandedScanPaths($pathScans) { if (count($pathScans) === 1) { self::setPathScan($pathScans[0]); return; } self::$pathScan = self::commonScanPath($pathScans); self::$scanPathFilters = $pathScans; } protected static function expandScanPaths($paths) { $expanded = []; foreach ($paths as $path) { if (!is_string($path) || trim($path) === '') { continue; } $path = trim($path); $isPattern = (bool)preg_match('/[*?\[{]/', $path); $globFlags = defined('GLOB_BRACE') ? constant('GLOB_BRACE') : 0; $matches = $isPattern ? glob($path, $globFlags) : [$path]; if (!is_array($matches) || empty($matches)) { throw new \InvalidArgumentException('Scan path did not match any files or directories: ' . $path); } foreach ($matches as $match) { $realPath = realpath($match); if ($realPath === false || !is_readable($realPath)) { throw new \InvalidArgumentException('Scan path is not readable: ' . $match); } $key = DIRECTORY_SEPARATOR === '\\' ? strtolower($realPath) : $realPath; $expanded[$key] = $realPath; } } return array_values($expanded); } protected static function isFtpSource($path) { if (!is_string($path)) { return false; } $scheme = parse_url($path, PHP_URL_SCHEME); return is_string($scheme) && in_array(strtolower($scheme), ['ftp', 'ftps'], true); } protected static function sanitizeFtpSource($uri) { $parts = parse_url($uri); $source = strtolower($parts['scheme']) . '://' . $parts['host']; if (isset($parts['port'])) { $source .= ':' . $parts['port']; } return $source . (isset($parts['path']) ? $parts['path'] : '/'); } protected function rewriteFtpReportPaths() { foreach ($this->ftpSourceMap as $localPath => $source) { foreach (['infectedFound', 'fileHashes'] as $reportKey) { $rewritten = []; foreach (self::$report[$reportKey] as $path => $value) { $rewritten[str_replace($localPath, $source, $path)] = $value; } self::$report[$reportKey] = $rewritten; } foreach (self::$report['ignored'] as $index => $ignored) { self::$report['ignored'][$index] = str_replace($localPath, $source, $ignored); } foreach (self::$report['findings'] as $index => $finding) { if (!is_array($finding) || !isset($finding['subject']) || strpos($finding['subject'], $localPath) !== 0) { continue; } $subject = str_replace($localPath, $source, $finding['subject']); $rewritten = Finding::create( $finding['kind'], $subject, $finding['rule_id'], $finding['severity'], $finding['message'], isset($finding['evidence']) ? $finding['evidence'] : [], $finding['provider'] ); foreach (['status', 'first_seen_at', 'last_seen_at', 'ignore'] as $field) { if (array_key_exists($field, $finding)) { $rewritten[$field] = $finding[$field]; } } self::$report['findings'][$index] = $rewritten; } } } protected static function commonScanPath($paths) { $common = is_file($paths[0]) ? dirname($paths[0]) : $paths[0]; foreach (array_slice($paths, 1) as $path) { $path = is_file($path) ? dirname($path) : $path; while (!self::isPathWithin($path, $common)) { $parent = dirname($common); if ($parent === $common) { throw new \InvalidArgumentException('Scan paths must share a common filesystem root'); } $common = $parent; } } return $common; } protected static function isPathWithin($path, $root) { $path = rtrim($path, DIRECTORY_SEPARATOR); $root = rtrim($root, DIRECTORY_SEPARATOR); if (DIRECTORY_SEPARATOR === '\\') { $path = strtolower($path); $root = strtolower($root); } return $path === $root || strpos($path, $root . DIRECTORY_SEPARATOR) === 0; } /** * @return int */ public static function getMaxFilesize() { return self::$maxFilesize; } /** * @return self */ public static function setMaxFilesize($maxFilesize) { $maxFilesize = trim($maxFilesize); if (!is_numeric(self::$argv['max-filesize'])) { $maxFilesize = Path::sizeToBytes($maxFilesize); } self::$maxFilesize = $maxFilesize; return new self(); } /** * @return array */ public static function getExtensions() { return self::$extensions; } private static function scanControlRequest() { if (self::$pathScanControl === null || !is_file(self::$pathScanControl) || is_link(self::$pathScanControl)) { return null; } $value = @file_get_contents(self::$pathScanControl, false, null, 0, 16); $value = is_string($value) ? strtolower(trim($value)) : ''; return in_array($value, ['paused', 'cancelled'], true) ? $value : null; } private static function touchScanHeartbeat($force = false) { if (self::$pathScanHeartbeat === null || is_link(self::$pathScanHeartbeat)) { return; } $now = microtime(true); if (!$force && $now - self::$lastHeartbeatWrite < self::HEARTBEAT_TIME_INTERVAL) { return; } if (file_exists(self::$pathScanHeartbeat) && !is_file(self::$pathScanHeartbeat)) { return; } if (@touch(self::$pathScanHeartbeat)) { self::$lastHeartbeatWrite = $now; } } private static function clearScanHeartbeat() { if (self::$pathScanHeartbeat !== null && is_file(self::$pathScanHeartbeat) && !is_link(self::$pathScanHeartbeat)) { @unlink(self::$pathScanHeartbeat); } } private static function shouldScanDomains() { return !isset(self::$settings['scan-domains']) || self::$settings['scan-domains']; } private static function allEligibleFilesVerified() { if (!self::isVerifierEnabled()) { return false; } $coverage = isset(self::$report['coverage']) && is_array(self::$report['coverage']) ? self::$report['coverage'] : []; $eligible = isset($coverage['eligible']) ? (int)$coverage['eligible'] : 0; $verified = isset($coverage['verified']) ? (int)$coverage['verified'] : 0; return $eligible > 0 && $eligible === $verified; } private static function shouldScanDomainsForPath($path) { if (!self::shouldScanDomains()) { return false; } if (!isset(self::$settings['domain-analysis-scope']) || self::$settings['domain-analysis-scope'] === 'all') { return true; } $extension = strtolower(pathinfo((string)$path, PATHINFO_EXTENSION)); return in_array($extension, [ 'php', 'php3', 'ph3', 'php4', 'ph4', 'php5', 'ph5', 'php7', 'ph7', 'php8', 'ph8', 'phtm', 'phtml', 'js', 'css', 'ccss', 'html', 'htm', 'json', 'xml', ], true) || strtolower(basename((string)$path)) === '.htaccess'; } private function scanDomains($content, $subject) { $domains = (new DomainExtractor())->extract($content); return (new DomainScanner(self::$maltrailDefinitions))->scan($domains, $subject); } private function scanOversizedScript($path, array $sizeFinding) { $findings = [$sizeFinding['key'] => $this->formatSourceSizeFinding($sizeFinding)]; if (!self::shouldScanSignatures()) { return $findings; } $handle = @fopen($path, 'rb'); if ($handle === false) { throw new \RuntimeException(sprintf('Unable to read "%s".', $path)); } try { $first = fread($handle, self::OVERSIZED_SIGNATURE_SAMPLE_BYTES); if (!is_string($first)) { throw new \RuntimeException(sprintf('Unable to read "%s".', $path)); } $samples = [$first]; if (fseek($handle, -self::OVERSIZED_SIGNATURE_SAMPLE_BYTES, SEEK_END) === 0) { $last = fread($handle, self::OVERSIZED_SIGNATURE_SAMPLE_BYTES); if (is_string($last) && $last !== $first) { $samples[] = $last; } } } finally { fclose($handle); } foreach ($samples as $sample) { $this->scanRawSignatureSample($sample, $findings); } return $findings; } private function scanRawSignatureSample($content, array &$findings) { foreach (Signatures::getAll() as $key => $pattern) { $signatureHash = hash('crc32b', (string)$key); if (self::isLiteMode() && in_array($signatureHash, self::LITE_SIGNATURE_EXCLUSIONS, true)) { continue; } $regexPattern = '#' . $pattern . '#smiS'; if (@preg_match($regexPattern, $content, $matches, PREG_OFFSET_CAPTURE) !== 1) { continue; } $match = $matches[0][0]; if (self::isLiteMode() && isset(self::LITE_SIGNATURE_MATCH_EXCLUSIONS[$signatureHash]) && in_array(strtolower($match), self::LITE_SIGNATURE_MATCH_EXCLUSIONS[$signatureHash], true)) { continue; } $description = 'Malware Signature (hash: ' . $signatureHash . ')'; $findings['sign' . $signatureHash . hash('crc32b', $match)] = [ 'type' => 'sign', 'key' => $signatureHash, 'level' => CodeMatch::DANGEROUS, 'output' => CodeMatch::getText('Signature', $signatureHash, $description, $match), 'description' => $description, 'line' => null, 'pattern' => $regexPattern, 'match' => $match, ]; } } private function formatSourceSizeFinding(array $finding) { $type = 'file_size'; return [ 'type' => $type, 'key' => $finding['key'], 'level' => $finding['level'], 'output' => CodeMatch::getText( $type, $finding['key'], $finding['description'], $finding['match'], $finding['line'] ), 'description' => $finding['description'], 'line' => $finding['line'], 'pattern' => 'script file size safety limit', 'match' => $finding['match'], 'provider' => 'builtin-source-size', ]; } private function scanJavascriptDefinitions($content) { $findings = []; foreach (Exploits::getJavascript() as $key => $definition) { if (!preg_match($definition['pattern'], $content, $match, PREG_OFFSET_CAPTURE)) { continue; } $matchedText = $match[0][0]; $lineNumber = CodeMatch::getLineNumber($matchedText, $content, $match[0][1]); $findings['javascript-' . $key] = [ 'type' => 'javascript', 'key' => $key, 'level' => $definition['level'], 'output' => CodeMatch::getText('javascript', $key, $definition['description'], $matchedText, $lineNumber), 'description' => $definition['description'], 'line' => $lineNumber, 'pattern' => $definition['pattern'], 'match' => $matchedText, 'provider' => 'builtin-javascript', ]; if (isset($definition['link'])) { $findings['javascript-' . $key]['link'] = $definition['link']; } } return $findings; } /** * @return self */ public static function setFunctions($functions) { self::$functions = $functions; self::$functionsEncoded = $functions; self::$scanCacheFingerprint = null; return new self(); } /** * @param array $functions * * @return self */ public static function setFunctionsEncoded($functions) { $dangerousFunctions = Functions::getDangerous(); $encodedFunc = array_unique(array_merge($functions, $dangerousFunctions)); self::$functionsEncoded = $encodedFunc; self::$scanCacheFingerprint = null; return new self(); } /** * @param array $exploits * * @return self */ public static function setExploits($exploits) { self::$exploits = $exploits; self::$scanCacheFingerprint = null; return new self(); } /** * @param array $extensions * * @return self */ public static function setExtensions($extensions) { self::$extensions = $extensions; return new self(); } /** * @return string */ public static function getReportFormat() { return self::$reportFormat; } /** * @return int */ public static function getReportFilesScanned() { return self::$report['scanned']; } /** * @return int */ public static function getReportMalwareDetected() { return self::$report['detected']; } /** * @return array */ public static function getReportMalwareRemoved() { return self::$report['removed']; } /** * @return array */ public static function getReportFilesIgnored() { return self::$report['ignored']; } /** * @return array */ public static function getReportFilesEdited() { return self::$report['edited']; } /** * @return array */ public static function getReportQuarantine() { return self::$report['quarantine']; } /** * @return array */ public static function getReportWhitelist() { return self::$report['quarantine']; } /** * @return string */ public static function getLowerName() { return strtolower(self::$name); } /** * @return string */ public static function getName() { return self::$name; } /** * @return string */ public static function getFullName() { return self::$fullname; } /** * @return string */ public static function getVersion() { return self::$version; } /** * @return string */ public static function getRoot() { return self::$root; } /** * @return Argv */ public static function getArgv() { return self::$argv; } /** * @return array */ public static function getWhitelist() { return self::$whitelist; } /** * @param array $whitelist * * @return self */ public static function setWhitelist($whitelist) { self::$whitelist = $whitelist; return new self(); } /** * @return array */ public static function getFunctions() { return self::$functions; } /** * @return array */ public static function getFunctionsEncoded() { return self::$functionsEncoded; } /** * @return array */ public static function getExploits() { return array_keys(self::$exploits); } /** * @return array */ public static function getSettings() { return self::$settings; } public static function setAiApiKey($apiKey) { $previous = self::$aiApiKey; if ($apiKey !== null && (!is_string($apiKey) || strlen($apiKey) > 4096 || preg_match('/[\x00-\x1F\x7F]/', $apiKey))) { throw new \InvalidArgumentException('The AI API key is invalid.'); } self::$aiApiKey = $apiKey === null ? null : trim($apiKey); return $previous; } /** * @return object */ public static function getReport() { return (object)self::$report; } private static function resetReport() { self::$report = [ 'scanned' => 0, 'detected' => 0, 'verifiedByChecksum' => 0, 'removed' => [], 'ignored' => [], 'edited' => [], 'quarantine' => [], 'whitelist' => [], 'infectedFound' => [], 'fileHashes' => [], 'findings' => [], 'coverage' => self::emptyCoverage(), ]; } private static function emptyCoverage() { return [ 'discovered' => 0, 'eligible' => 0, 'scanned' => 0, 'skipped' => 0, 'verified' => 0, 'cached' => 0, 'errors' => 0, 'reasons' => [ 'path' => 0, 'extension' => 0, 'oversized' => 0, 'excluded' => 0, 'unreadable' => 0, 'archive_limit' => 0, ], ]; } private static function addMalwareFindings($filePath, array $patterns, $isFavicon) { if ($isFavicon && empty($patterns)) { self::$report['findings'][] = Finding::create( 'malware', $filePath, 'suspicious-favicon-name', 'danger', 'The file name matches a suspicious favicon pattern.', [], 'builtin' ); return; } foreach ($patterns as $pattern) { $type = isset($pattern['type']) ? (string)$pattern['type'] : 'pattern'; $key = isset($pattern['key']) ? (string)$pattern['key'] : hash('sha256', serialize($pattern)); self::$report['findings'][] = Finding::create( 'malware', $filePath, $type . ':' . $key, isset($pattern['level']) ? (string)$pattern['level'] : 'warn', isset($pattern['description']) ? (string)$pattern['description'] : 'A suspicious pattern was detected.', [ 'line' => isset($pattern['line']) ? $pattern['line'] : null, 'match' => isset($pattern['match']) ? $pattern['match'] : '', 'content_hash' => is_file($filePath) ? hash_file('sha256', $filePath) : null, ], isset($pattern['provider']) ? (string)$pattern['provider'] : 'builtin' ); } } private function configureSecurityFeatures() { self::$settings['scan-archives'] = !empty(self::$argv['scan-archives']); self::$settings['scan-wordpress-db'] = !empty(self::$argv['scan-wordpress-db']); $administratorThreshold = self::$argv['wordpress-admin-threshold']; if ((!is_int($administratorThreshold) && !is_string($administratorThreshold)) || filter_var($administratorThreshold, FILTER_VALIDATE_INT, ['options' => ['min_range' => 1]]) === false) { throw new \InvalidArgumentException('--wordpress-admin-threshold must be a positive integer.'); } self::$settings['wordpress-admin-threshold'] = (int)$administratorThreshold; $adminWhitelist = []; $mainWhitelistPath = self::$pathWhitelist; if (is_file($mainWhitelistPath) && is_readable($mainWhitelistPath)) { $mainWhitelist = Whitelist::read($mainWhitelistPath); if (!empty($mainWhitelist)) { $adminWhitelist = Whitelist::getWpAdminWhitelist($mainWhitelist); } } self::$settings['wordpress-admin-whitelist'] = $adminWhitelist; self::$settings['wordpress-admin-whitelist-path'] = $mainWhitelistPath; self::$settings['check-updates'] = !empty(self::$argv['check-updates']); self::$settings['scan-domains'] = empty(self::$argv['disable-domain-analysis']); $domainScope = strtolower(trim((string)self::$argv['domain-analysis-scope'])); if (!in_array($domainScope, ['scripts', 'all'], true)) { throw new \InvalidArgumentException('--domain-analysis-scope must be scripts or all.'); } self::$settings['domain-analysis-scope'] = $domainScope; self::$settings['resume'] = !empty(self::$argv['resume']); self::$pathFindings = !empty(self::$argv['findings-store']) ? Path::get(self::$argv['findings-store']) : null; self::$pathCheckpoint = !empty(self::$argv['checkpoint']) ? Path::get(self::$argv['checkpoint']) : null; self::$pathScanControl = !empty(self::$argv['scan-control']) ? Path::get(self::$argv['scan-control']) : null; self::$pathScanHeartbeat = !empty(self::$argv['scan-heartbeat']) ? Path::get(self::$argv['scan-heartbeat']) : null; self::$maltrailDefinitions = null; self::$definitionBundleMetadata = null; $definitionsPath = !empty(self::$argv['path-definitions']) ? Path::get(self::$argv['path-definitions']) : MaltrailDefinitionStore::getDefaultPath(); $reloadSignatures = class_exists(Signatures::class, false) && !Signatures::hasCustomDefinitions(); $reloadExploits = class_exists(Exploits::class, false); $usesBuiltInExploits = empty(self::$exploits); if ($reloadExploits && !$usesBuiltInExploits) { $usesBuiltInExploits = self::$exploits === Exploits::getAll() || self::$exploits === Exploits::getLite(); } $bundleStore = new DefinitionBundleStore( $definitionsPath . DIRECTORY_SEPARATOR . 'amwscan', null, null, self::$argv['definitions-update-url'], self::getVersion() ); try { if (!empty(self::$argv['disable-definitions-update'])) { $bundleStore->load(); } else { $bundleStore->refresh(); } } catch (\Throwable $exception) { if ($bundleStore->getActivePath() === null) { $bundleStore->load(); } self::$report['diagnostics'][] = $bundleStore->isUsingBundled() ? 'AMWScan definition update failed; using the embedded bundle: ' . $exception->getMessage() : 'AMWScan definition update failed; using the cached bundle: ' . $exception->getMessage(); } self::$definitionBundleMetadata = is_file($bundleStore->getActivePath()) ? RuleData::useArchive($bundleStore->getActivePath(), self::getVersion()) : RuleData::useDirectory($bundleStore->getActivePath()); try { RuleData::useDefinitions((new LocalDefinitionSource(self::$argv['path-local-rules']))->merge([ 'signatures' => RuleData::load('signatures'), 'exploits' => RuleData::load('exploits'), 'hashes' => RuleData::load('hashes'), 'functions' => RuleData::load('functions'), ])); } catch (\Throwable $exception) { self::$report['diagnostics'][] = 'Local AMWScan rules were ignored: ' . $exception->getMessage(); } if ($reloadSignatures) { Signatures::reloadDefinitions(); } if ($reloadExploits) { Exploits::reloadDefinitions(); if ($usesBuiltInExploits) { self::$exploits = []; } } Functions::reloadDefinitions(); if (self::shouldScanDomains()) { $store = new MaltrailDefinitionStore($definitionsPath); try { if (!empty(self::$argv['disable-definitions-update'])) { $store->load(); } else { $store->refresh(); } } catch (\Throwable $exception) { self::$report['diagnostics'][] = $store->isActive() ? 'Maltrail definition update failed; using the cached index: ' . $exception->getMessage() : 'Maltrail definitions are unavailable: ' . $exception->getMessage(); } if ($store->isActive()) { self::$maltrailDefinitions = $store; } elseif (!empty(self::$argv['disable-definitions-update'])) { self::$report['diagnostics'][] = 'No cached Maltrail definitions are available.'; } } } private function configureAiReview($isCLI) { $provider = strtolower(trim((string)self::$argv['ai-provider'])); if (!in_array($provider, FindingReviewer::providers(), true)) { throw new \InvalidArgumentException('Unsupported --ai-provider value.'); } if (!$isCLI && substr($provider, -4) === '-cli') { throw new \InvalidArgumentException('Local AI CLI providers are available only from the CLI.'); } foreach (['ai-context-lines' => [0, 20], 'ai-max-findings' => [1, 100], 'ai-timeout' => [5, 300]] as $key => $range) { if (filter_var(self::$argv[$key], FILTER_VALIDATE_INT) === false || (int)self::$argv[$key] < $range[0] || (int)self::$argv[$key] > $range[1]) { throw new \InvalidArgumentException(sprintf('--%s must be between %d and %d.', $key, $range[0], $range[1])); } } self::$settings['ai-provider'] = $provider; self::$settings['ai-model'] = self::$argv['ai-model'] !== null ? trim((string)self::$argv['ai-model']) : null; self::$settings['ai-context-lines'] = (int)self::$argv['ai-context-lines']; self::$settings['ai-max-findings'] = (int)self::$argv['ai-max-findings']; self::$settings['ai-timeout'] = (int)self::$argv['ai-timeout']; self::$settings['ai-executable'] = self::$argv['ai-executable'] !== null ? trim((string)self::$argv['ai-executable']) : null; } private function reviewFindingsWithAi() { if (empty(self::$settings['ai-provider']) || self::$settings['ai-provider'] === 'disabled') { return; } $result = (new FindingReviewer())->review(self::$report['findings'], [ 'provider' => self::$settings['ai-provider'], 'model' => self::$settings['ai-model'], 'context_lines' => self::$settings['ai-context-lines'], 'max_findings' => self::$settings['ai-max-findings'], 'timeout' => self::$settings['ai-timeout'], 'executable' => self::$settings['ai-executable'], 'api_key' => self::$aiApiKey, ], static function () { self::touchScanHeartbeat(true); }); self::$report['findings'] = $result['findings']; self::$report['ai_review'] = $result['summary']; $this->attachAiReviewsToDetectedPatterns(); if (!empty($result['errors'])) { self::$report['ai_review_errors'] = $result['errors']; } } private function attachAiReviewsToDetectedPatterns() { $reviews = []; foreach (self::$report['findings'] as $finding) { if (!is_array($finding) || !isset($finding['kind'], $finding['subject'], $finding['rule_id'], $finding['evidence']) || $finding['kind'] !== 'malware' || !is_array($finding['evidence']) || empty($finding['evidence']['ai_review']) || !is_array($finding['evidence']['ai_review'])) { continue; } $key = str_replace('\\', '/', (string)$finding['subject']) . '|' . (string)$finding['rule_id']; $reviews[$key][] = $finding['evidence']['ai_review']; } foreach (self::$report['infectedFound'] as $filePath => &$patterns) { $normalizedFilePath = str_replace('\\', '/', (string)$filePath); foreach ($patterns as &$pattern) { $ruleId = (isset($pattern['type']) ? (string)$pattern['type'] : 'pattern') . ':' . (isset($pattern['key']) ? (string)$pattern['key'] : ''); $key = $normalizedFilePath . '|' . $ruleId; if (!empty($reviews[$key])) { $pattern['ai_review'] = array_shift($reviews[$key]); } } unset($pattern); } unset($patterns); } private static function setSignatureIndexReportMetadata() { self::$report['signature_indexes'] = [ 'amwscan_bundle' => [ 'version' => self::$definitionBundleMetadata['version'], 'sequence' => self::$definitionBundleMetadata['sequence'], 'manifest_sha256' => self::$definitionBundleMetadata['manifestSha256'], ], 'known_malware_md5_prefixes' => [ 'records' => Signatures::getKnownMalwareMd5PrefixCount(), 'source_sha256' => Signatures::getKnownMalwareIndexSha256(), ], 'legacy_core_sha256' => [ 'records' => Signatures::getLegacyCoreSha256Count(), 'source_sha256' => Signatures::getLegacyCoreIndexSha256(), ], ]; if (self::$maltrailDefinitions !== null) { $metadata = self::$maltrailDefinitions->getMetadata(); self::$report['signature_indexes']['maltrail_domains'] = [ 'records' => $metadata['records'], 'source_sha256' => $metadata['source_sha256'], 'index_sha256' => $metadata['index_sha256'], 'updated_at' => $metadata['updated_at'], ]; } } private function runSupplementalAnalyses() { if (!isset(self::$report['diagnostics'])) { self::$report['diagnostics'] = []; } if (self::isVerifierEnabled() && is_dir(self::$pathScan)) { try { self::touchScanHeartbeat(true); self::$report['findings'] = array_merge( self::$report['findings'], $this->platforms->integrityFindings(self::$pathScan) ); } catch (\Throwable $exception) { self::$report['diagnostics'][] = 'Integrity analysis failed: ' . $exception->getMessage(); } } if (!is_dir(self::$pathScan)) { return; } try { self::touchScanHeartbeat(true); $components = $this->platforms->inventory(self::$pathScan); self::$report['inventory'] = $this->platforms->enrichInventory($components, !empty(self::$settings['check-updates'])); } catch (\Throwable $exception) { self::$report['diagnostics'][] = 'Component inventory failed: ' . $exception->getMessage(); } if (!self::shouldScanDomains() || self::allEligibleFilesVerified()) { return; } try { self::touchScanHeartbeat(true); $contentInventory = $this->platforms->contentInventoryResult(self::$pathScan); $records = $contentInventory['records']; self::$report['coverage']['content'] = $contentInventory['coverage']; self::$report['coverage']['content']['scanned'] = 0; foreach ($records as $record) { self::touchScanHeartbeat(); self::$report['findings'] = array_merge( self::$report['findings'], $this->scanDomains($record['content'], $record['subject']) ); self::$report['coverage']['content']['scanned']++; } } catch (\Throwable $exception) { self::$report['diagnostics'][] = 'Content reputation analysis failed: ' . $exception->getMessage(); } } private function reconcileFindings() { self::touchScanHeartbeat(true); if (self::$pathFindings === null) { return; } $reasons = self::$report['coverage']['reasons']; $resolveMissing = empty(self::$report['diagnostics']) && empty(self::$settings['offset']) && empty(self::$settings['limit']) && empty(self::$report['coverage']['errors']) && empty($reasons['oversized']) && empty($reasons['unreadable']) && empty($reasons['archive_limit']) && (!isset(self::$report['coverage']['archives']['complete']) || self::$report['coverage']['archives']['complete']) && (!isset(self::$report['coverage']['content']['complete']) || self::$report['coverage']['content']['complete']); self::$report['findings'] = (new FindingStore(self::$pathFindings))->reconcile( self::$report['findings'], null, self::checkpointConfigurationHash(), $resolveMissing ); self::$report['coverage']['authoritative'] = $resolveMissing; } /** * @return bool */ public function isInterrupted() { return $this->interrupt; } /** * @return string */ public function getLastError() { return $this->lastError; } /** * @param string $lastError * * @return self */ protected function setLastError($lastError) { $this->lastError = $lastError; return $this; } /** * @return bool */ protected static function shouldScanExploits() { return isset(self::$settings['scan-exploits']) ? self::$settings['scan-exploits'] : true; } /** * @return bool */ protected static function shouldScanFunctions() { return isset(self::$settings['scan-functions']) ? self::$settings['scan-functions'] : true; } /** * @return bool */ protected static function shouldScanSignatures() { return isset(self::$settings['scan-signatures']) ? self::$settings['scan-signatures'] : true; } /** * @return string */ public static function getDescription() { return self::$description; } /** * @return string */ public static function getRepoUrl() { return self::$repoUrl; } /** * @return string */ public static function getAuthor() { return self::$author; } /** * @return bool */ public function isInterrupt() { return $this->interrupt; } /** * @return bool */ protected static function isInitialized() { return self::$inited; } /** * @return string */ public static function getLatestVersionUrl() { return self::$latestVersionUrl; } /** * @return string */ public static function getLatestReleaseUrl() { return self::$latestReleaseUrl; } /** * @return bool */ public static function isScanAll() { return self::$scanAll; } /** * @param bool $scanAll */ public static function setScanAll($scanAll) { self::$scanAll = $scanAll; } } providerFactory = new ProviderFactory($httpRequest, $processRunner); } public static function providers() { return ProviderFactory::names(); } public function review(array $findings, array $configuration, ?callable $heartbeat = null) { $provider = isset($configuration['provider']) ? strtolower((string)$configuration['provider']) : 'disabled'; if ($provider === 'disabled') { return ['findings' => $findings, 'summary' => null, 'errors' => []]; } if (!in_array($provider, self::providers(), true)) { throw new \InvalidArgumentException('Unsupported AI review provider.'); } $providerAdapter = $this->providerFactory->create($provider); $contextLines = $this->boundedInteger($configuration, 'context_lines', 5, 0, 20); $maximum = $this->boundedInteger($configuration, 'max_findings', 20, 1, 100); $timeout = $this->boundedInteger($configuration, 'timeout', 30, 5, 300); $effectiveModel = $providerAdapter->model($configuration); $reviewed = 0; $attempted = 0; $skipped = 0; $errors = []; $retries = 0; $failed = 0; $candidateIndexes = array_keys(array_filter($findings, function ($finding) { return $this->isReviewable($finding); })); usort($candidateIndexes, function ($left, $right) use ($findings) { $priority = $this->reviewPriority($findings[$left]) <=> $this->reviewPriority($findings[$right]); return $priority !== 0 ? $priority : $left <=> $right; }); foreach ($candidateIndexes as $index) { if ($heartbeat !== null) { call_user_func($heartbeat); } $finding = $findings[$index]; if ($attempted >= $maximum) { $skipped++; continue; } $attempted++; try { $context = $this->codeContext($finding['subject'], isset($finding['evidence']['line']) ? $finding['evidence']['line'] : null, $contextLines); $request = $this->reviewRequest($finding, $context); list($reviewResult, $providerAttempts) = $this->requestVerdict( $providerAdapter, $request, array_merge($configuration, ['timeout' => $timeout]) ); $retries += $providerAttempts - 1; $verdict = $reviewResult->toArray(); $verdict['schema_version'] = 1; $verdict['status'] = 'completed'; $verdict['provider'] = $provider; $verdict['model'] = $effectiveModel; $verdict['reviewed_at'] = gmdate('c'); $verdict['provider_attempts'] = $providerAttempts; $verdict['context_start_line'] = $context['start']; $verdict['context_end_line'] = $context['end']; $verdict['redacted'] = !empty($request->payload()['redaction_count']); $verdict['redaction_count'] = isset($request->payload()['redaction_count']) ? (int)$request->payload()['redaction_count'] : 0; if (!isset($finding['evidence']) || !is_array($finding['evidence'])) { $finding['evidence'] = []; } $finding['evidence']['ai_review'] = $verdict; $findings[$index] = $finding; $reviewed++; } catch (\Throwable $error) { $status = $error instanceof BlockedException ? 'blocked' : 'failed'; $errorResult = [ 'schema_version' => 1, 'status' => $status, 'provider' => $provider, 'model' => $effectiveModel, 'reviewed_at' => gmdate('c'), 'error_type' => get_class($error), 'message' => mb_substr($this->safeText($error->getMessage()), 0, 1000), ]; if (!isset($finding['evidence']) || !is_array($finding['evidence'])) { $finding['evidence'] = []; } $finding['evidence']['ai_review'] = $errorResult; $findings[$index] = $finding; $errors[] = array_merge(['finding_id' => isset($finding['id']) ? $finding['id'] : ''], $errorResult); $failed++; } } return [ 'findings' => $findings, 'summary' => [ 'schema_version' => 1, 'status' => $failed === 0 ? 'completed' : ($reviewed > 0 ? 'partial' : 'failed'), 'provider' => $provider, 'model' => $effectiveModel, 'reviewed' => $reviewed, 'attempted' => $attempted, 'failed' => $failed, 'skipped_limit' => $skipped, 'errors' => count($errors), 'provider_retries' => $retries, ], 'errors' => $errors, ]; } private function isReviewable($finding) { return is_array($finding) && isset($finding['kind'], $finding['subject']) && in_array($finding['kind'], ['malware', 'keyword', 'encoded-function-candidate', 'exploit-candidate'], true) && is_string($finding['subject']) && is_file($finding['subject']) && !is_link($finding['subject']) && is_readable($finding['subject']); } private function codeContext($path, $line, $radius) { if (filesize($path) > 8388608) { throw new \RuntimeException('The detected file is too large for AI review.'); } $contents = file_get_contents($path); if (!is_string($contents)) { throw new \RuntimeException('Unable to read the detected file.'); } $lines = explode("\n", str_replace(["\r\n", "\r"], "\n", $contents)); $target = filter_var($line, FILTER_VALIDATE_INT) !== false ? (int)$line : 1; $target = max(1, min(count($lines), $target)); $start = max(1, $target - $radius); $end = min(count($lines), $target + $radius); $selected = []; for ($number = $start; $number <= $end; $number++) { $text = preg_replace('/[^\P{C}\t]/u', '', $lines[$number - 1]); $selected[] = sprintf('%6d | %s', $number, mb_substr(is_string($text) ? $text : '', 0, 2000)); } return ['start' => $start, 'end' => $end, 'code' => mb_substr(implode("\n", $selected), 0, 24000)]; } private function reviewRequest(array $finding, array $context) { $match = isset($finding['evidence']['match']) && is_scalar($finding['evidence']['match']) ? mb_substr((string)$finding['evidence']['match'], 0, 2000) : ''; list($safeMatch, $matchRedactions) = $this->redactSensitiveContent($this->safeText($match)); list($safeContext, $contextRedactions) = $this->redactSensitiveContent($context['code']); return new ReviewRequest([ 'rule' => $this->safeText(isset($finding['rule_id']) ? $finding['rule_id'] : ''), 'severity' => $this->safeText(isset($finding['severity']) ? $finding['severity'] : ''), 'detector_message' => $this->safeText(isset($finding['message']) ? $finding['message'] : ''), 'review_guidance' => $this->reviewGuidance(isset($finding['rule_id']) ? (string)$finding['rule_id'] : '', $finding['kind']), 'matched_text' => $safeMatch, 'code_context' => $safeContext, 'redaction_count' => $matchRedactions + $contextRedactions, ]); } private function requestVerdict(ProviderInterface $provider, ReviewRequest $request, array $configuration) { for ($attempt = 1; $attempt <= self::MAX_PROVIDER_ATTEMPTS; $attempt++) { try { return [$provider->review($request, $configuration), $attempt]; } catch (InvalidStructuredOutputException $error) { if (!$provider->retriesInvalidOutput() || $attempt === self::MAX_PROVIDER_ATTEMPTS) { throw $error; } } catch (RetryableProviderException $error) { if ($attempt === self::MAX_PROVIDER_ATTEMPTS) { throw $error; } usleep((100000 * (2 ** ($attempt - 1))) + random_int(0, 50000)); } } throw new InvalidStructuredOutputException('The AI provider did not return a valid verdict.'); } private function boundedInteger(array $configuration, $key, $default, $minimum, $maximum) { $value = isset($configuration[$key]) && filter_var($configuration[$key], FILTER_VALIDATE_INT) !== false ? (int)$configuration[$key] : $default; return max($minimum, min($maximum, $value)); } private function safeText($value) { return trim((string)preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/', '', (string)$value)); } private function reviewPriority(array $finding) { $severity = strtolower(isset($finding['severity']) ? (string)$finding['severity'] : ''); $rule = strtolower(isset($finding['rule_id']) ? (string)$finding['rule_id'] : ''); $priority = in_array($severity, ['info', 'notice', 'warn', 'warning', 'medium'], true) ? 0 : 30; if (strpos($rule, 'function:') === 0 || strpos($rule, 'encoded-function:') === 0) { return $priority; } if (strpos($rule, 'exploit:') === 0) { return $priority + 10; } if (strpos($rule, 'signature:') === 0) { return $priority + 20; } return $priority + 40; } private function reviewGuidance($rule, $kind) { if ($kind === 'exploit-candidate') { return 'An unconfirmed Lite heuristic is not evidence of malware. Encoded names, concatenations, callback decoding, or nearby calls alone do not establish malicious data flow. Trace indirect decoding and execution; return uncertain if the connection is outside the supplied context.'; } $rule = strtolower($rule); if (strpos($rule, 'encoded-function:') === 0) { return 'An encoded name alone is not evidence of malware. Look for indirect decoding through variables, array keys, custom functions, or file reads and whether the reconstructed value reaches execution. Return uncertain when the relevant data flow is outside the supplied context.'; } if (strpos($rule, 'keyword:') === 0) { return 'A generic word alone is not evidence of malware. Distinguish labels, comments, and documentation from executable malicious behavior; do not confirm malware solely from the matched word.'; } if (strpos($rule, 'function:') === 0) { return 'Determine whether arguments are fixed trusted data or attacker-controlled, and whether the return value reaches execution, inclusion, decoding, or output.'; } if (strpos($rule, 'exploit:') === 0) { return 'Distinguish generated, cached, vendor, test, or compatibility code from deployed executable obfuscation, persistence, injection, or command execution.'; } if (strpos($rule, 'signature:') === 0) { return 'Compare the complete surrounding syntax with benign minified, fixture, documentation, and encoded asset patterns before confirming a signature match.'; } if (strpos($rule, 'hash:') === 0) { return 'A trusted malware hash is strong evidence; return uncertain rather than false_positive unless the evidence clearly shows a non-executable test fixture or hash collision context.'; } return 'Evaluate execution reachability, attacker control, persistence, obfuscation, and whether the snippet is deployed executable code or inert data.'; } private function redactSensitiveContent($content) { $count = 0; $patterns = [ '/-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/i' => '[REDACTED_PRIVATE_KEY]', '/\b(?:sk_(?:live|test)|rk_(?:live|test)|pk_(?:live|test)|sk-proj|github_pat|gh[pousr]|xox[baprs]|AIza|AKIA)[-_A-Za-z0-9]{12,}\b/' => '[REDACTED_API_KEY]', '/\bBearer\s+[A-Za-z0-9._~+\/-]{16,}=*/i' => 'Bearer [REDACTED_TOKEN]', '/((?:DB_PASSWORD|AUTH_KEY|SECURE_AUTH_KEY|LOGGED_IN_KEY|NONCE_KEY|AUTH_SALT|SECURE_AUTH_SALT|LOGGED_IN_SALT|NONCE_SALT|password|passwd|pwd)\s*[=:>,]\s*[\"\'])([^\"\'\r\n]{4,})([\"\'])/i' => '$1[REDACTED_SECRET]$3', '~\b([a-z][a-z0-9+.-]*://[^\s:/]+:)[^@\s]+@~i' => '$1[REDACTED_PASSWORD]@', ]; foreach ($patterns as $pattern => $replacement) { $content = preg_replace($pattern, $replacement, $content, -1, $replacements); $count += $replacements; } return [is_string($content) ? $content : '', $count]; } } httpRequest = $httpRequest; $this->processRunner = $processRunner; } public static function names() { $providers = array_merge(['disabled'], self::PROVIDERS); if (function_exists('wp_ai_client_prompt')) { $providers[] = 'wordpress-ai'; } return $providers; } public function create($name) { $providers = [ 'openai' => OpenAIProvider::class, 'anthropic' => AnthropicProvider::class, 'gemini' => GeminiProvider::class, 'claude-code-cli' => ClaudeCodeCliProvider::class, 'codex-cli' => CodexCliProvider::class, 'copilot-cli' => CopilotCliProvider::class, 'opencode-cli' => OpenCodeCliProvider::class, 'wordpress-ai' => WordPressAIProvider::class, ]; if (!isset($providers[$name]) || ($name === 'wordpress-ai' && !function_exists('wp_ai_client_prompt'))) { throw new \InvalidArgumentException('Unsupported AI review provider.'); } $class = $providers[$name]; if ($name === 'wordpress-ai') { return new $class(); } $callback = substr($name, -4) === '-cli' ? $this->processRunner : $this->httpRequest; return new $class($callback); } } apiKey($configuration, 'ANTHROPIC_API_KEY'); if ($key === '') { throw new AuthenticationException('Anthropic API key is not configured.'); } // phpcs:ignore PluginCheck.CodeAnalysis.AIProvider.DirectIntegration -- Standalone and legacy WordPress fallback; WordPress AI is preferred when available. $response = $this->requestJson('https://api.anthropic.com/v1/messages', [ 'x-api-key' => $key, 'anthropic-version' => '2023-06-01', 'Content-Type' => 'application/json', ], [ 'model' => $this->model($configuration), 'max_tokens' => 640, 'system' => $request->systemInstructions(), 'messages' => [['role' => 'user', 'content' => $request->userContent()]], 'output_config' => ['format' => ['type' => 'json_schema', 'schema' => ReviewRequest::schema(false)]], ], $configuration); $stopReason = isset($response['stop_reason']) ? (string)$response['stop_reason'] : ''; if (in_array($stopReason, ['refusal', 'content_filtered'], true)) { throw new BlockedException('Anthropic blocked or refused the supplied code.'); } if ($stopReason === 'max_tokens') { throw new IncompleteException('Anthropic exhausted the output token limit.'); } $text = ''; foreach (isset($response['content']) ? (array)$response['content'] : [] as $content) { if (isset($content['type']) && $content['type'] === 'text' && isset($content['text']) && is_string($content['text'])) { $text .= $content['text']; } } $decoded = json_decode($text, true); return ReviewResult::fromArray(is_array($decoded) ? $decoded : [], [ 'request_id' => isset($response['id']) ? (string)$response['id'] : '', 'usage' => isset($response['usage']) && is_array($response['usage']) ? $response['usage'] : [], ]); } } apiKey($configuration, 'OPENAI_API_KEY'); if ($key === '') { throw new AuthenticationException('OpenAI API key is not configured.'); } // phpcs:ignore PluginCheck.CodeAnalysis.AIProvider.DirectIntegration -- Standalone and legacy WordPress fallback; WordPress AI is preferred when available. $response = $this->requestJson('https://api.openai.com/v1/responses', [ 'Authorization' => 'Bearer ' . $key, 'Content-Type' => 'application/json', ], [ 'model' => $this->model($configuration), 'instructions' => $request->systemInstructions(), 'input' => $request->userContent(), 'store' => false, 'max_output_tokens' => 640, 'text' => ['format' => ['type' => 'json_schema', 'name' => 'malware_verdict', 'strict' => true, 'schema' => ReviewRequest::schema()]], ], $configuration); if (isset($response['status']) && $response['status'] !== 'completed') { $details = isset($response['incomplete_details']['reason']) ? ': ' . $response['incomplete_details']['reason'] : ''; throw new IncompleteException('OpenAI returned response status ' . $response['status'] . $details . '.'); } if (!empty($response['error'])) { throw new IncompleteException('OpenAI returned a response error.'); } $text = ''; if (isset($response['output_text']) && is_string($response['output_text'])) { $text = $response['output_text']; } foreach ($text === '' && isset($response['output']) ? (array)$response['output'] : [] as $item) { foreach (isset($item['content']) ? (array)$item['content'] : [] as $content) { if (isset($content['type']) && $content['type'] === 'refusal') { throw new BlockedException('OpenAI refused to review the supplied code.'); } if (isset($content['text']) && is_string($content['text'])) { $text = $content['text']; break 2; } } } if ($text === '' && isset($response['choices'][0]['message']['content'])) { $text = $response['choices'][0]['message']['content']; } return ReviewResult::fromArray($this->decodeVerdict($text), [ 'request_id' => isset($response['id']) ? (string)$response['id'] : '', 'usage' => isset($response['usage']) && is_array($response['usage']) ? $response['usage'] : [], ]); } private function decodeVerdict($text) { $decoded = is_string($text) ? json_decode($text, true) : null; return is_array($decoded) ? $decoded : []; } } httpRequest = $httpRequest; } protected function apiKey(array $configuration, $environmentVariable) { if (!empty($configuration['api_key']) && is_string($configuration['api_key'])) { return trim($configuration['api_key']); } $generic = getenv('AMWSCAN_AI_API_KEY'); if (is_string($generic) && $generic !== '') { return trim($generic); } $key = getenv($environmentVariable); return is_string($key) ? trim($key) : ''; } protected function requestJson($url, array $headers, array $payload, array $configuration) { $body = json_encode($payload, JSON_UNESCAPED_SLASHES | JSON_INVALID_UTF8_SUBSTITUTE); if (!is_string($body) || strlen($body) > 131072) { throw new ProviderException('The AI request is too large.'); } $timeout = isset($configuration['timeout']) ? (int)$configuration['timeout'] : 30; if ($this->httpRequest !== null) { $response = call_user_func($this->httpRequest, $url, $headers, $body, $timeout); } elseif (function_exists('wp_remote_post')) { $response = $this->wordpressRequest($url, $headers, $body, $timeout); } else { $response = $this->nativeRequest($url, $headers, $body, $timeout); } if (is_string($response)) { $response = json_decode($response, true); } if (!is_array($response)) { throw new InvalidStructuredOutputException('The AI provider returned invalid JSON.'); } return $response; } public function retriesInvalidOutput() { return false; } private function wordpressRequest($url, array $headers, $body, $timeout) { $response = wp_remote_post($url, [ 'headers' => $headers, 'body' => $body, 'timeout' => $timeout, 'redirection' => 0, 'data_format' => 'body', 'limit_response_size' => 262144, ]); if (function_exists('is_wp_error') && is_wp_error($response)) { throw new TransportException($response->get_error_message()); } $status = (int)wp_remote_retrieve_response_code($response); $contents = (string)wp_remote_retrieve_body($response); $this->assertHttpStatus($status); return $contents; } private function nativeRequest($url, array $headers, $body, $timeout) { $headerLines = []; foreach ($headers as $name => $value) { $headerLines[] = $name . ': ' . $value; } $context = stream_context_create(['http' => [ 'method' => 'POST', 'header' => implode("\r\n", $headerLines), 'content' => $body, 'timeout' => $timeout, 'ignore_errors' => true, 'follow_location' => 0, ], 'ssl' => ['verify_peer' => true, 'verify_peer_name' => true]]); $handle = @fopen($url, 'rb', false, $context); if ($handle === false) { throw new TransportException('Unable to connect to the AI provider.'); } $contents = stream_get_contents($handle, 262145); $metadata = stream_get_meta_data($handle); fclose($handle); if (!is_string($contents) || strlen($contents) > 262144) { throw new ProviderException('The AI response exceeded the size limit.'); } $status = 0; foreach (isset($metadata['wrapper_data']) ? (array)$metadata['wrapper_data'] : [] as $header) { if (preg_match('/^HTTP\/\S+\s+(\d{3})/', $header, $matches)) { $status = (int)$matches[1]; } } $this->assertHttpStatus($status); return $contents; } private function assertHttpStatus($status) { if ($status >= 200 && $status < 300) { return; } if ($status === 401 || $status === 403) { throw new AuthenticationException('The AI provider rejected the configured credentials (HTTP ' . $status . ').'); } if ($status === 429) { throw new RateLimitException('The AI provider rate limit was reached (HTTP 429).'); } if ($status >= 500) { throw new TransportException('The AI provider returned HTTP ' . $status . '.'); } throw new ProviderException('The AI provider returned HTTP ' . $status . '.'); } } apiKey($configuration, 'GEMINI_API_KEY'); if ($key === '') { throw new AuthenticationException('Gemini API key is not configured.'); } // phpcs:ignore PluginCheck.CodeAnalysis.AIProvider.DirectIntegration -- Standalone and legacy WordPress fallback; WordPress AI is preferred when available. $response = $this->requestJson( 'https://generativelanguage.googleapis.com/v1beta/models/' . rawurlencode($this->model($configuration)) . ':generateContent', ['x-goog-api-key' => $key, 'Content-Type' => 'application/json'], [ 'systemInstruction' => ['parts' => [['text' => $request->systemInstructions()]]], 'contents' => [['parts' => [['text' => $request->userContent()]]]], 'generationConfig' => [ 'maxOutputTokens' => 640, 'responseFormat' => ['text' => ['mimeType' => 'application/json', 'schema' => ReviewRequest::schema()]], ], ], $configuration ); if (!empty($response['promptFeedback']['blockReason'])) { throw new BlockedException('Gemini blocked the supplied code: ' . $response['promptFeedback']['blockReason'] . '.'); } $candidate = isset($response['candidates'][0]) && is_array($response['candidates'][0]) ? $response['candidates'][0] : []; $finishReason = isset($candidate['finishReason']) ? (string)$candidate['finishReason'] : ''; if (in_array($finishReason, ['SAFETY', 'BLOCKLIST', 'PROHIBITED_CONTENT', 'SPII'], true)) { throw new BlockedException('Gemini blocked the supplied code: ' . $finishReason . '.'); } if ($finishReason === 'MAX_TOKENS') { throw new IncompleteException('Gemini exhausted the output token limit.'); } $text = isset($candidate['content']['parts'][0]['text']) ? $candidate['content']['parts'][0]['text'] : ''; $decoded = is_string($text) ? json_decode($text, true) : null; return ReviewResult::fromArray(is_array($decoded) ? $decoded : [], [ 'request_id' => isset($response['responseId']) ? (string)$response['responseId'] : '', 'usage' => isset($response['usageMetadata']) && is_array($response['usageMetadata']) ? $response['usageMetadata'] : [], ]); } } userContent()) ->using_system_instruction($request->systemInstructions()) ->as_json_response(ReviewRequest::schema(false)); if ($this->model($configuration) === 'auto' && function_exists('WordPress\\AI\\get_preferred_models_for_text_generation') && method_exists($builder, 'using_model_preference')) { $models = \WordPress\AI\get_preferred_models_for_text_generation(); if (!empty($models)) { $builder = $builder->using_model_preference(...$models); } } elseif ($this->model($configuration) !== 'auto' && method_exists($builder, 'using_model_preference')) { $parts = explode('/', $this->model($configuration), 2); if (count($parts) === 2 && $parts[0] !== '' && $parts[1] !== '') { $builder = $builder->using_model_preference([$parts[0], $parts[1]]); } } if (method_exists($builder, 'is_supported_for_text_generation') && !$builder->is_supported_for_text_generation()) { throw new ProviderException('No configured WordPress AI connector supports text generation.'); } $result = $builder->generate_text(); if (function_exists('is_wp_error') && is_wp_error($result)) { $code = $result->get_error_code(); if ($code === 'wpai_connector_not_approved') { throw new BlockedException('AMWScan is not approved to use the configured WordPress AI connector.'); } if (in_array($code, ['rest_forbidden', 'unauthorized', 'authentication_error'], true)) { throw new AuthenticationException($result->get_error_message()); } throw new ProviderException($result->get_error_message()); } return ReviewResult::fromText((string)$result, ['upstream_provider' => '', 'usage' => []]); } public function retriesInvalidOutput() { return false; } } executable($configuration, 'codex'), 'exec', '--ephemeral', '--ignore-user-config', '--ignore-rules', '--skip-git-repo-check', '--sandbox', 'read-only', '--output-schema', $workingDirectory . DIRECTORY_SEPARATOR . 'verdict-schema.json', '--color', 'never', ]; if (!empty($configuration['model'])) { $command[] = '--model'; $command[] = (string)$configuration['model']; } $command[] = '-'; return $command; } protected function stdin(ReviewRequest $request) { return $request->textPrompt(); } } userContent()) === false) { throw new \RuntimeException('Unable to prepare the Copilot review request.'); } @chmod($path, 0600); } protected function command(array $configuration, ReviewRequest $request, $workingDirectory) { $command = [ $this->executable($configuration, 'copilot'), '--available-tools', 'read', '--allow-tool', 'read', '--deny-tool', 'shell', 'write', '--disable-builtin-mcps', '--no-custom-instructions', '--silent', '--no-color', '--stream', 'off', ]; if (!empty($configuration['model'])) { $command[] = '--model'; $command[] = (string)$configuration['model']; } $command[] = '-p'; $command[] = $request->systemInstructions() . ' Read review-request.json with the read-only tool and return only JSON matching this schema: ' . json_encode(ReviewRequest::schema(), JSON_UNESCAPED_SLASHES); return $command; } protected function stdin(ReviewRequest $request) { return ''; } } processRunner = $processRunner; } public function model(array $configuration) { return !empty($configuration['model']) ? (string)$configuration['model'] : ''; } public function review(ReviewRequest $request, array $configuration) { $timeout = isset($configuration['timeout']) ? (int)$configuration['timeout'] : 30; $workingDirectory = $this->createWorkingDirectory(); try { $this->prepare($request, $workingDirectory); $command = $this->command($configuration, $request, $workingDirectory); $stdin = $this->stdin($request); if ($this->processRunner !== null) { $output = (string)call_user_func($this->processRunner, $command, $stdin, $timeout, $workingDirectory); } else { $output = $this->runProcess($command, $stdin, $timeout, $workingDirectory, $this->environment()); } return ReviewResult::fromText($output); } finally { $this->removeWorkingDirectory($workingDirectory); } } public function retriesInvalidOutput() { return true; } abstract protected function command(array $configuration, ReviewRequest $request, $workingDirectory); protected function prepare(ReviewRequest $request, $workingDirectory) { } protected function stdin(ReviewRequest $request) { return $request->userContent(); } protected function environment() { return null; } protected function executable(array $configuration, $default) { return !empty($configuration['executable']) ? (string)$configuration['executable'] : $default; } private function runProcess(array $command, $stdin, $timeout, $workingDirectory, $environment) { $pipes = []; $process = @proc_open($command, [['pipe', 'r'], ['pipe', 'w'], ['pipe', 'w']], $pipes, $workingDirectory, $environment, ['bypass_shell' => true]); if (!is_resource($process)) { throw new TransportException('Unable to start the configured AI CLI.'); } fwrite($pipes[0], $stdin); fclose($pipes[0]); stream_set_blocking($pipes[1], false); stream_set_blocking($pipes[2], false); $stdout = ''; $stderr = ''; $started = microtime(true); do { $stdout .= stream_get_contents($pipes[1]); $stderr .= stream_get_contents($pipes[2]); $status = proc_get_status($process); if (strlen($stdout) > 262144 || strlen($stderr) > 65536) { proc_terminate($process); throw new ProviderException('The AI CLI output exceeded the size limit.'); } if (microtime(true) - $started > $timeout) { proc_terminate($process); throw new TransportException('The AI CLI timed out.'); } if ($status['running']) { usleep(20000); } } while ($status['running']); $stdout .= stream_get_contents($pipes[1]); $stderr .= stream_get_contents($pipes[2]); fclose($pipes[1]); fclose($pipes[2]); $exitCode = proc_close($process); if ($exitCode !== 0 && $exitCode !== -1) { throw new ProviderException('The AI CLI failed: ' . mb_substr(trim($stderr), 0, 500)); } return $stdout; } private function createWorkingDirectory() { $directory = sys_get_temp_dir() . DIRECTORY_SEPARATOR . 'amwscan-ai-' . bin2hex(random_bytes(8)); if (!mkdir($directory, 0700) && !is_dir($directory)) { throw new TransportException('Unable to create the isolated AI CLI directory.'); } return $directory; } private function removeWorkingDirectory($directory) { foreach (glob($directory . DIRECTORY_SEPARATOR . '*') ?: [] as $path) { if (is_file($path) || is_link($path)) { @unlink($path); } } @rmdir($directory); } } executable($configuration, 'claude'), '--restricted', '--tools', '', '--no-session-persistence', '--max-turns', '1', '--json-schema', json_encode(ReviewRequest::schema(), JSON_UNESCAPED_SLASHES), '--output-format', 'json', '--system-prompt', $request->systemInstructions(), ]; if (!empty($configuration['model'])) { $command[] = '--model'; $command[] = (string)$configuration['model']; } $command[] = '-p'; $command[] = 'Review the JSON request supplied through standard input and return the schema-constrained verdict.'; return $command; } } userContent()) === false) { throw new \RuntimeException('Unable to prepare the OpenCode review request.'); } @chmod($path, 0600); } protected function command(array $configuration, ReviewRequest $request, $workingDirectory) { $command = [ $this->executable($configuration, 'opencode'), 'run', '--pure', '--format', 'json', '--dir', $workingDirectory, '--file', $workingDirectory . DIRECTORY_SEPARATOR . 'review-request.json', ]; if (!empty($configuration['model'])) { $command[] = '--model'; $command[] = (string)$configuration['model']; } $command[] = $request->systemInstructions() . ' Review the attached JSON request and return only JSON matching this schema: ' . json_encode(ReviewRequest::schema(), JSON_UNESCAPED_SLASHES); return $command; } protected function stdin(ReviewRequest $request) { return ''; } protected function environment() { $environment = getenv(); if (!is_array($environment)) { return null; } $environment['OPENCODE_PERMISSION'] = json_encode(['*' => 'deny']); $environment['OPENCODE_DISABLE_DEFAULT_PLUGINS'] = 'true'; $environment['OPENCODE_DISABLE_CLAUDE_CODE'] = 'true'; return $environment; } } payload = $payload; } public function systemInstructions() { return self::SYSTEM_INSTRUCTIONS; } public function payload() { return $this->payload; } public function userContent() { $json = json_encode($this->payload, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_INVALID_UTF8_SUBSTITUTE); if (!is_string($json)) { throw new \RuntimeException('Unable to encode the AI review request.'); } return $json; } public function textPrompt() { return $this->systemInstructions() . "\n\nReview this JSON data and return only the required verdict object:\n" . $this->userContent(); } public static function schema($boundedConfidence = true) { $confidence = ['type' => 'number']; if ($boundedConfidence) { $confidence['minimum'] = 0; $confidence['maximum'] = 1; } return [ 'type' => 'object', 'properties' => [ 'verdict' => ['type' => 'string', 'enum' => ['malware', 'false_positive', 'uncertain']], 'confidence' => $confidence, 'reason' => ['type' => 'string'], ], 'required' => ['verdict', 'confidence', 'reason'], 'additionalProperties' => false, ]; } } verdict = $verdict; $this->confidence = $confidence; $this->reason = $reason; $this->metadata = $metadata; } public static function fromArray(array $result, array $metadata = []) { $verdict = isset($result['verdict']) ? strtolower(str_replace(['-', ' '], '_', (string)$result['verdict'])) : ''; $confidence = isset($result['confidence']) && is_numeric($result['confidence']) ? (float)$result['confidence'] : null; $reason = isset($result['reason']) && is_string($result['reason']) ? self::safeText($result['reason']) : ''; if (!in_array($verdict, ['malware', 'false_positive', 'uncertain'], true) || $confidence === null || $confidence < 0 || $confidence > 1 || $reason === '') { throw new InvalidStructuredOutputException('The AI provider returned a verdict that does not match the required schema.'); } return new self($verdict, $confidence, mb_substr($reason, 0, 2000), $metadata); } public static function fromText($text, array $metadata = []) { $text = trim((string)$text); $candidates = [$text]; if (preg_match_all('/\{(?:[^{}]|(?R))*\}/s', $text, $matches)) { $candidates = array_reverse(array_merge($candidates, $matches[0])); } foreach ($candidates as $candidate) { $decoded = json_decode($candidate, true); if (!is_array($decoded)) { continue; } if (isset($decoded['structured_output']) && is_array($decoded['structured_output'])) { return self::fromArray($decoded['structured_output'], $metadata); } if (isset($decoded['verdict'])) { return self::fromArray($decoded, $metadata); } foreach (['result', 'text', 'message', 'content', 'output_text'] as $field) { if (isset($decoded[$field]) && is_string($decoded[$field])) { try { return self::fromText($decoded[$field], $metadata); } catch (InvalidStructuredOutputException $error) { } } } } throw new InvalidStructuredOutputException('The AI provider did not return a valid verdict.'); } public function toArray() { return array_merge([ 'verdict' => $this->verdict, 'confidence' => $this->confidence, 'reason' => $this->reason, ], $this->metadata); } private static function safeText($value) { return trim((string)preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/', '', (string)$value)); } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Console; use AMWScan\Detection\Exploits; use AMWScan\Detection\Functions; use AMWScan\Scan\Scanner; /** * Class Console * Console manager. */ class CLI { /** * Font colors. * * @var array */ public static $foregroundColors = [ 'black' => '0;30', 'dark_gray' => '1;30', 'blue' => '0;34', 'light_blue' => '1;34', 'green' => '0;32', 'light_green' => '1;32', 'cyan' => '0;36', 'light_cyan' => '1;36', 'red' => '0;31', 'light_red' => '1;31', 'purple' => '0;35', 'light_purple' => '1;35', 'brown' => '0;33', 'yellow' => '1;33', 'light_gray' => '0;37', 'white' => '1;37', ]; /** * Background colors. * * @var array */ public static $backgroundColors = [ 'black' => '40', 'red' => '41', 'green' => '42', 'yellow' => '43', 'blue' => '44', 'magenta' => '45', 'cyan' => '46', 'light_gray' => '47', ]; /** * Max default line length. * * @var int */ public static $maxLineLength = 80; /** * Get new line char. * * @return string */ public static function eol($n) { $eol = ''; for ($i = 0; $i < $n; $i++) { $eol .= PHP_EOL; } return $eol; } /** * Print header. */ public static function header() { if (!Scanner::isCli() || Scanner::isSilentMode()) { return; } $figlet = new Figlet(); $header = Scanner::getName(); if ($figlet->loadRandomFont()) { $header = $figlet->render($header); } $header .= "\n\nGithub: " . Scanner::getRepoUrl(); $headerArray = explode("\n", $header); foreach ($headerArray as $key => $value) { $diff = strlen($value) - mb_strlen($value); $headerArray[$key] = str_pad($value, self::$maxLineLength + $diff, ' ', STR_PAD_BOTH); } $header = implode(PHP_EOL, $headerArray); $version = Scanner::getVersion(); self::newLine(); self::displayLine($header, 2, 'green'); $title = self::title('version ' . $version); self::display($title, 'green'); self::newLine(2); $title = self::title(''); self::display($title, 'black', 'green'); self::newLine(); $title = self::title(Scanner::getFullName()); self::display($title, 'black', 'green'); self::newLine(); $title = self::title('Created by ' . Scanner::getAuthor()); self::display($title, 'black', 'green'); self::newLine(); $title = self::title(''); self::display($title, 'black', 'green'); self::newLine(2); $context = stream_context_create(['http' => ['timeout' => 2]]); $version = @file_get_contents(Scanner::getLatestVersionUrl(), false, $context); if (!empty($version) && version_compare(Scanner::$version, $version, '<')) { self::write('New version', 'green'); self::write(' ' . $version . ' ', 'green'); self::writeLine('of the scanner available!', 2, 'green'); } } /** * Print title. * * @param string $char * @param int $length * * @return string */ public static function title($text, $char = ' ', $length = null) { if ($length === null) { $length = self::$maxLineLength; } $result = ''; $strLength = strlen($text); $spaces = $length - $strLength; $spacesLenHalf = $spaces / 2; $spacesLenLeft = round($spacesLenHalf); $spacesLenRight = round($spacesLenHalf); if ((round($spacesLenHalf) - $spacesLenHalf) >= 0.5) { $spacesLenLeft--; } for ($i = 0; $i < $spacesLenLeft; $i++) { $result .= $char; } $result .= $text; for ($i = 0; $i < $spacesLenRight; $i++) { $result .= $char; } return $result; } /** * Print progress. * * @param float $done * @param float $total * @param int $size */ public static function progress($done, $total, $size = 30) { static $startTime; if (Scanner::isSilentMode() || $done > $total || $total === 0) { return; } if (empty($startTime)) { $startTime = time(); } $now = time(); $perc = (float)($done / $total); $bar = floor($perc * $size); $statusBar = "\r["; $statusBar .= str_repeat('=', $bar); if ($bar < $size) { $statusBar .= '>'; $statusBar .= str_repeat(' ', $size - $bar); } else { $statusBar .= '='; } $disp = number_format($perc * 100); $statusBar .= "] $disp%"; $rate = $done !== 0.0 ? ($now - $startTime) / max(1, $done) : ($now - $startTime); $left = $total - $done; $eta = round($rate * $left, 2); $etaType = 'sec'; $elapsed = $now - $startTime; $elapsedType = 'sec'; if ($eta > 59) { $etaType = 'min'; $eta = round($eta / 60); } if ($elapsed > 59) { $elapsedType = 'min'; $elapsed = round($elapsed / 60); } self::display("$statusBar ", 'black', 'green'); self::display(' '); self::display("$done/$total", 'green'); self::display(' [' . number_format($elapsed) . ' ' . $elapsedType . '/' . number_format($eta) . ' ' . $etaType . ']'); @ob_flush(); @flush(); if ($done === $total) { self::newLine(); } } /** * Display title bar. */ public static function displayTitle($string, $foregroundColor, $backgroundColor) { $title = self::title(''); self::display($title, $foregroundColor, $backgroundColor); self::newLine(); $title = self::title(strtoupper($string)); self::display($title, $foregroundColor, $backgroundColor); self::newLine(); $title = self::title(''); self::display($title, $foregroundColor, $backgroundColor); self::newLine(); } /** * Print break without writing logs. * * @param int $eol */ public static function newLine($eol = 1) { self::write(self::eol($eol), 'white', null, false); } /** * Print message without writing logs. * * @param int $eol * @param string $foregroundColor * @param null $backgroundColor * @param bool $escape */ public static function displayLine($string, $eol = 1, $foregroundColor = 'white', $backgroundColor = null, $escape = true) { self::write($string . self::eol($eol), $foregroundColor, $backgroundColor, false, $escape); } /** * Choice. * * @return string */ public static function choice($question, $options) { foreach ($options as $key => $value) { self::displayOption($key, $value); } self::newLine(2); return self::read(trim($question) . ' ', 'purple'); } /** * Print option. * * @param string $foregroundColor * @param null $backgroundColor * @param bool $escape */ public static function displayOption($num, $string, $foregroundColor = 'white', $backgroundColor = null, $escape = true) { self::write(' [' . $num . '] ' . $string . self::eol(1), $foregroundColor, $backgroundColor, false, $escape); } /** * Print message without writing logs. * * @param string $foregroundColor * @param null $backgroundColor */ public static function display($string, $foregroundColor = 'white', $backgroundColor = null, $escape = true) { self::write($string, $foregroundColor, $backgroundColor, false, $escape); } /** * Print break. * * @param int $eol */ public static function writeBreak($eol = 1) { self::write(self::eol($eol)); } /** * Print message and print eol. * * @param string $string * @param int $eol * @param string $foregroundColor * @param null $backgroundColor * @param null $log * @param bool $escape */ public static function writeLine($string, $eol = 1, $foregroundColor = 'white', $backgroundColor = null, $log = null, $escape = true) { self::write($string . self::eol($eol), $foregroundColor, $backgroundColor, $log, $escape); } /** * Print message. * * @param string|null $foregroundColor * @param string|null $backgroundColor * @param null $log */ public static function write($string, $foregroundColor = 'white', $backgroundColor = null, $log = null, $escape = true) { $returnString = $string; if (!Scanner::isColorEnabled()) { $foregroundColor = null; $backgroundColor = null; } if (Scanner::isLogEnabled() && $log === null) { $log = true; } if ($escape) { $returnString = self::escape($returnString); } $coloredString = ''; if ($foregroundColor !== null && isset(self::$foregroundColors[$foregroundColor])) { $coloredString .= "\033[" . self::$foregroundColors[$foregroundColor] . 'm'; } if ($backgroundColor !== null && isset(self::$backgroundColors[$backgroundColor])) { $coloredString .= "\033[" . self::$backgroundColors[$backgroundColor] . 'm'; } $coloredString .= $returnString . "\033[0m"; if (!Scanner::isSilentMode()) { if (Scanner::isColorEnabled()) { echo $coloredString; } else { echo $returnString; } } if ($log) { self::log($string, !empty($foregroundColor) && $foregroundColor !== 'white' ? $foregroundColor : $backgroundColor); } } /** * Read input. * * @param string|null $string * @param string|null $foregroundColor * @param null $backgroundColor * * @return string */ public static function read($string, $foregroundColor = 'white', $backgroundColor = null) { if (!self::isInteractive()) { return ''; } if (!Scanner::isColorEnabled()) { $foregroundColor = null; $backgroundColor = null; } $coloredString = ''; if ($foregroundColor != null && isset(self::$foregroundColors[$foregroundColor])) { $coloredString .= "\033[" . self::$foregroundColors[$foregroundColor] . 'm'; } if ($backgroundColor != null && isset(self::$backgroundColors[$backgroundColor])) { $coloredString .= "\033[" . self::$backgroundColors[$backgroundColor] . 'm'; } $coloredString .= $string . "\033[0m"; $read = null; if (!Scanner::isSilentMode()) { if (Scanner::isColorEnabled()) { echo Scanner::getLowerName() . ' > ' . trim($coloredString) . ' '; } else { echo Scanner::getLowerName() . ' > ' . trim($string) . ' '; } } if (self::isWindows()) { $read = stream_get_line(STDIN, 1024, PHP_EOL); } else { $in = [STDIN]; $out = []; $oob = []; while (@stream_select($in, $out, $oob, 0)) { if (fgets(STDIN) === false) { break; } $in = [STDIN]; } $read = fgets(STDIN); $read = $read === false ? '' : rtrim($read); } return (string)$read; } /** * Print code. * * @param array $errors * @param bool $log */ public static function code($string, $errors = [], $log = false) { $code = self::escape($string); foreach ($errors as $pattern) { $match = self::escape($pattern['match']); if ($match === '' || !Scanner::isColorEnabled()) { continue; } $code = str_replace($match, "\033[" . self::$foregroundColors['red'] . 'm' . $match . "\033[" . self::$foregroundColors['white'] . 'm', $code); } $lines = explode("\n", $code); foreach ($lines as $i => $iValue) { if ($i !== 0) { self::newLine(); } self::display(' ' . str_pad((string)($i + 1), strlen((string)count($lines)), ' ', STR_PAD_LEFT) . ' | ', 'yellow'); self::display($iValue, 'white', null, false); } if ($log) { self::log($string); } } /** * Write logs. * * @param string $color */ public static function log($string, $color = '') { $string = trim($string); if (!empty($string)) { $string = trim($string, '.'); $string = str_replace(self::eol(1), ' ', $string); $string = preg_replace("/[\s]+/m", ' ', $string); $type = 'INFO'; switch ($color) { case 'green': $type = 'SUCCESS'; break; case 'yellow': $type = 'WARNING'; break; case 'red': $type = 'DANGER'; break; } $string = '[' . date('Y-m-d H:i:s') . '] [' . $type . '] ' . $string . PHP_EOL; file_put_contents(Scanner::getPathLogs(), $string, FILE_APPEND); } } /** * Escape colors string. * * @return string */ public static function escape($string) { $cleaned = preg_replace('/\x1B\[[0-?]*[ -\/]*[@-~]/', '', $string); $cleaned = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/', '', $cleaned); $encoding = mb_detect_encoding($cleaned, mb_detect_order(), true); $encoding = ($encoding && $encoding !== 'AUTO') ? $encoding : 'UTF-8'; return mb_convert_encoding($cleaned, 'UTF-8', $encoding); } /** * Print lists. * * @param null $type */ public static function helplist($type = null) { if (!Scanner::isCli()) { return; } $list = ''; if (empty($type) || $type === 'exploits') { $exploitList = implode(self::eol(1) . '- ', array_keys(Exploits::getAll())); $list .= self::eol(1) . 'Exploits:' . self::eol(1) . "- $exploitList"; } if (empty($type)) { $list .= self::eol(1); } if (empty($type) || $type === 'functions') { $functionsList = implode(self::eol(1) . '- ', Functions::getDefault()); $list .= self::eol(1) . 'Functions:' . self::eol(1) . "- $functionsList"; } if (empty($type)) { $list .= self::eol(1); } if (empty($type) || $type === 'functions-encoded') { $functionsList = implode(self::eol(1) . '- ', Functions::getDangerous()); $list .= self::eol(1) . 'Functions Encoded:' . self::eol(1) . "- $functionsList"; } self::displayTitle(trim($type . ' List'), 'black', 'cyan'); self::displayLine($list, 2); } /** * @return string */ public static function wordWrap($text) { return wordwrap($text, self::$maxLineLength); } /** * Print Helper. */ public static function helper() { if (!Scanner::isCli()) { return; } $name = Scanner::getLowerName(); $argv = Scanner::getArgv(); $argv->setExamples([ 'php ' . $name . ' ./mywebsite/http/ -l -s --only-exploits', 'php ' . $name . ' -s --max-filesize="5MB"', 'php ' . $name . ' -s -logs="/user/marco/scanner.log"', 'php ' . $name . ' --lite --only-exploits', 'php ' . $name . ' --exploits="double_var2" --functions="eval, str_replace"', 'php ' . $name . ' --ignore-paths="/my/path/*.log,/my/path/*/cache/*"', ]); $help = $argv->usage(); self::displayTitle('Help', 'black', 'cyan'); self::newLine(); self::displayLine(self::wordWrap('IMPORTANT: You will be solely responsible for any damage to your computer system or loss of data' . 'that results from such activities. You are solely responsible for adequate protection and backup' . 'of the data before execute the scanner.')); self::displayLine($help, 2); self::displayLine('Notes:'); self::displayLine('For open files with nano or vim run the scripts with "php -d disable_functions=\'\'"', 2); } /** * Is windows environment. * * @return bool */ public static function isWindows() { return stripos(PHP_OS, 'WIN') === 0; } /** * Override terminal detection for tests; silent mode and closed input still take precedence. * * @var bool|null */ public static $interactive; /** * Whether a prompt can actually be answered on the current STDIN. * * Returns false for silent runs, for non-CLI contexts, and whenever STDIN is * a pipe, a file, or closed rather than a terminal. Callers must not block on * input in those cases, because no answer will ever arrive. * * @return bool */ public static function isInteractive() { if (Scanner::isSilentMode() || !Scanner::isCli() || !defined('STDIN') || !is_resource(STDIN)) { return false; } if (self::$interactive !== null) { return (bool)self::$interactive; } if (function_exists('stream_isatty')) { return @stream_isatty(STDIN); } if (function_exists('posix_isatty')) { return @posix_isatty(STDIN); } return false; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Console; use AMWScan\Filesystem\ResourceLocator; class Figlet { /** * Path fonts. * * @var string */ public static $pathFonts; /** * Signature. * * @var string */ protected $signature; /** * Hard blank. * * @var string */ protected $hardblank; /** * Height. * * @var string */ protected $height; /** * Baseline. * * @var string */ protected $baseline; /** * Max lenght. * * @var string */ protected $maxLenght; /** * Old layout. * * @var string */ protected $oldLayout; /** * Comment line. * * @var int */ protected $commentLines; /** * Print direction. * * @var string */ protected $printDirection; /** * Full layout. * * @var string */ protected $fullLayout; /** * Code tag count. * * @var string */ protected $codeTagCount; /** * Font file. * * @var string */ protected $fontFile; /** * Figlet constructor. */ public function __construct() { self::$pathFonts = (new ResourceLocator())->getConsoleFontsDirectory(); } /** * Load a random flf font file. */ public function loadRandomFont() { if (!is_dir(self::$pathFonts)) { return false; } $font = null; $fonts = new \FilesystemIterator( self::$pathFonts, \FilesystemIterator::SKIP_DOTS ); $fontCount = iterator_count($fonts); if ($fontCount === 0) { return false; } $i = mt_rand(0, $fontCount - 1); $c = 0; foreach ($fonts as $file) { if ($i === $c) { $font = $file->getPathname(); break; } $c++; } return $this->loadFont($font); } /** * Load an flf font file. Return true on success, false on error. * * @return bool */ public function loadFont($fontfile) { if (!is_file($fontfile)) { $fontfile = self::$pathFonts . '/' . $fontfile; } $this->fontFile = file($fontfile); if (!$this->fontFile) { trigger_error("Couldn't open font $fontfile\n"); return false; } // Header $header = explode(' ', $this->fontFile[0]); $this->signature = substr($header[0], 0, -1); $this->hardblank = $header[0][strlen($header[0]) - 1]; $this->height = @$header[1]; $this->baseline = @$header[2]; $this->maxLenght = @$header[3]; $this->oldLayout = @$header[4]; $this->commentLines = ((int)@$header[5]) + 1; $this->printDirection = @$header[6]; $this->fullLayout = @$header[7]; $this->codeTagCount = @$header[8]; if ($this->signature !== 'flf2a') { trigger_error('Unknown font version ' . $this->signature . "\n"); return false; } return true; } /** * Get a character as a string, or an array with one line * for each font height. * * @return array|string */ public function getCharacter($character) { $asciValue = ord($character); $start = $this->commentLines + ($asciValue - 32) * $this->height; $data = []; // Check if character is out of bounds if ($start < 0 || $start >= count($this->fontFile)) { // Return empty lines for unsupported characters for ($a = 0; $a < $this->height; $a++) { $data[] = ''; } return $data; } for ($a = 0; $a < $this->height; $a++) { $lineIndex = $start + $a; if (!isset($this->fontFile[$lineIndex])) { $data[] = ''; continue; } $tmp = $this->fontFile[$lineIndex]; // Get the last character as separator (before newline) $tmp = rtrim($tmp, "\r\n"); if (strlen($tmp) > 0) { $separator = substr($tmp, -1); // Remove all occurrences of separator from the end $tmp = rtrim($tmp, $separator); } // Replace hardblank with space $tmp = str_replace($this->hardblank, ' ', $tmp); $data[] = $tmp; } return $data; } /** * Returns a figletized line of characters. * * @return string */ public function render($line) { $ret = ''; $data = []; for ($i = 0; $i < mb_strlen($line); $i++) { $data[] = $this->getCharacter(mb_substr($line, $i, 1)); } for ($i = 0; $i < $this->height; $i++) { foreach ($data as $v) { if (isset($v[$i])) { $ret .= str_replace("\n", '', $v[$i]); } } reset($data); $ret .= "\n"; } return trim($ret); } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Console; /** * Class Argument. */ class Argument { /** * @var string */ public $name; /** * @var bool */ public $vararg = false; /** * @var bool */ public $required = false; public $defaultValue; public $help; /** * Argument constructor. * * @param array $options */ public function __construct($name, $options = []) { $this->name = $name; $this->vararg = (bool)@$options['var_arg']; $this->required = (bool)@$options['required']; $this->defaultValue = @$options['default']; $this->help = @$options['help']; } /** * @return string */ public function __toString() { $arg = "<{$this->name}>"; if ($this->vararg) { $arg = "$arg ..."; } if (!$this->required) { return "[$arg]"; } return $arg; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Console; /** * Class Argv. */ class Argv implements \ArrayAccess { /** * @var null */ protected $name; /** * @var string */ protected $description; /** * @var array */ protected $examples = []; /** * @var array */ protected $flags = []; /** * @var array */ protected $args = []; /** * @var array */ protected $parsedFlags = []; /** * @var array */ protected $providedFlags = []; /** * @var array */ protected $parsedNamedArgs = []; /** * @var array */ protected $parsedArgs = []; /** * Build. * * @return static */ public static function build($callback) { $static = new static(); $bindTo = [$callback, 'bindTo']; if ($callback instanceof \Closure && is_callable($bindTo)) { $callback = $callback->bindTo($static); } $callback($static); return $static; } /** * Argv constructor. * * @param string $description * @param null $name * @param array $examples */ public function __construct($name = '', $description = '', $examples = []) { $this->description = $description; $this->name = $name; $this->examples = $examples; } /** * @param array $examples */ public function setExamples($examples) { $this->examples = $examples; } /** * Parse argvs. * * @param array $args */ public function parse($args = []) { if (empty($args) && !empty($_SERVER['argv'])) { $args = array_slice($_SERVER['argv'], 1); // First argument removed (php [scanner.php] [] []) } foreach ($args as $pos => $arg) { // reset value $value = null; if (substr($arg, 0, 1) === '-') { if (preg_match('/^(.+)=(?:\"|\\\')?(.+)(?:\"|\\\')?/', $arg, $matches)) { $arg = $matches[1]; $value = $matches[2]; } if (!$flag = @$this->flags[$arg]) { fwrite(STDERR, "Error: Unknown flag '{$arg}'\n"); exit(1); } unset($args[$pos]); if ($flag->hasValue) { if (!isset($value)) { $value = $args[$pos + 1]; unset($args[$pos + 1]); } } else { $value = true; } if (null !== $flag->callback) { call_user_func_array($flag->callback, [&$value]); } // Set the reference given as the flag's 'var'. $flag->var = $this->parsedFlags[$flag->name] = $value; $this->providedFlags[$flag->name] = true; } } foreach ($this->flags as $flag) { if (!array_key_exists($flag->name, $this->parsedFlags)) { $flag->var = $this->parsedFlags[$flag->name] = $flag->defaultValue; } } $this->parsedArgs = $args = array_values($args); $pos = 0; foreach ($this->args as $arg) { if ($arg->required && !isset($args[$pos])) { return; } if (isset($args[$pos])) { if ($arg->vararg) { $value = array_slice($args, $pos); $pos += count($value); } else { $value = $args[$pos]; $pos++; } } else { $value = $arg->defaultValue; } $this->parsedNamedArgs[$arg->name] = $value; } } /** * Add Flag. * * @param array $options * @param null $callback * * @return $this */ public function addFlag($name, $options = [], $callback = null) { $flag = new Flag($name, $options, $callback); foreach ($flag->aliases as $alias) { $this->flags[$alias] = $flag; } return $this; } /** * Add flag var. * * @param array $options * * @return Argv */ public function addFlagVar($name, &$var, $options = []) { $options['var'] = &$var; return $this->addFlag($name, $options); } /** * Add Argument. * * @param array $options * * @return $this */ public function addArgument($name, $options = []) { $argument = new Argument($name, $options); $this->args[] = $argument; return $this; } /** * Get arguments. * * @return array */ public function getParsedArgs() { return $this->parsedArgs; } /** * Count arguments. * * @return int */ public function count() { return count($this->getParsedArgs()); } /** * Get flag or argument. */ public function get($name) { return $this->flag($name) ?: $this->arg($name); } /** * Get argument from position. */ public function arg($pos) { if (array_key_exists($pos, $this->parsedNamedArgs)) { return $this->parsedNamedArgs[$pos]; } if (array_key_exists($pos, $this->parsedArgs)) { return $this->parsedArgs[$pos]; } return null; } /** * Get flag. */ public function flag($name) { if (array_key_exists($name, $this->parsedFlags)) { return $this->parsedFlags[$name]; } return null; } /** * Check whether a flag was explicitly provided. * * @return bool */ public function wasProvided($name) { return isset($this->providedFlags[$name]); } /** * Usage. * * @return string */ public function usage() { $flags = implode(' ', array_unique(array_values($this->flags))); $args = implode(' ', $this->args); $script = $this->name ?: 'php ' . basename($_SERVER['SCRIPT_NAME']); $usage = ''; if ($this->description !== '') { $usage .= "\n\n{$this->description}"; } if (count($this->args) > 0) { $usage .= "\n\nArguments:\n"; $printArgs = []; $length = 0; foreach ($this->args as $arg) { $key = "<{$arg->name}>"; if ($length < strlen($key)) { $length = strlen($key); } $printArgs[$key] = CLI::wordWrap($arg->help); if ($arg->defaultValue !== null) { $printArgs[$key] .= "\n[default: {$arg->defaultValue}]"; } } $length += 3; ksort($printArgs); foreach ($printArgs as $name => $description) { $name = str_pad($name, $length, ' ', STR_PAD_RIGHT); $spaces = str_repeat(' ', $length + 2); $description = '- ' . str_replace("\n", "\n" . $spaces, $description); $usage .= "\n{$name}{$description}"; } } if (count($this->flags) > 0) { $usage .= "\n\nFlags:\n"; $printFlags = []; $length = 0; foreach ($this->flags as $flag) { $names = ['--' . $flag->name]; if (!empty($flag->aliases)) { $names = array_merge($flag->aliases); } usort($names, function ($a, $b) { return strlen($b) - strlen($a); }); $key = implode('|', $names); if ($flag->hasValue) { $valueName = empty($flag->valueName) ? $flag->name : $flag->valueName; $key .= ' <' . $valueName . '>'; } if ($length < strlen($key)) { $length = strlen($key); } $printFlags[$key] = CLI::wordWrap($flag->help); if ($flag->hasValue && $flag->defaultValue !== null && $flag->defaultValue !== false) { $printFlags[$key] .= "\n[default: {$flag->defaultValue}]"; } } $length += 3; ksort($printFlags); foreach ($printFlags as $name => $description) { $name = str_pad($name, $length, ' ', STR_PAD_RIGHT); $spaces = str_repeat(' ', $length + 2); $description = '- ' . str_replace("\n", "\n" . $spaces, $description); $usage .= "\n{$name}{$description}"; } } $example = CLI::wordWrap("$script $flags $args"); $example = str_replace("\n", "\n\t", $example); $usage .= "\n\nUsage: $example"; if ($this->examples !== []) { $usage .= "\n\nExamples:\n\n" . implode("\n", $this->examples); } return $usage; } /** * @param null $length * * @return array */ public function slice($start, $length = null) { return array_slice($this->parsedArgs, $start, $length); } #[\ReturnTypeWillChange] public function offsetGet($offset) { return $this->get($offset); } /** * @return bool */ #[\ReturnTypeWillChange] public function offsetExists($offset) { return null !== $this->get($offset); } /** * Set Offest. */ #[\ReturnTypeWillChange] public function offsetSet($offset, $value) { } /** * Unset Offset. */ #[\ReturnTypeWillChange] public function offsetUnset($offset) { } } definitions($command, array_slice($arguments, 2)); } if ($group === 'rules') { return $this->rules($command, array_slice($arguments, 2)); } return null; } private function definitions($command, array $arguments) { $cachePath = MaltrailDefinitionStore::getDefaultPath() . DIRECTORY_SEPARATOR . 'amwscan'; $store = new DefinitionBundleStore($cachePath, null, null, null, Scanner::getVersion()); if ($command === 'update') { if (!$store->isUpdateConfigured()) { throw new \RuntimeException('No AMWDB update metadata URL is configured.'); } $store->refresh(); } elseif ($command === 'status' || $command === 'verify') { $store->load(); } elseif ($command === 'inspect' && isset($arguments[0])) { $bundle = (new DefinitionArchiveReader(Scanner::getVersion()))->read($arguments[0]); $this->writeMetadata($bundle['metadata']); return 0; } else { fwrite(STDERR, "Usage: amwscan definitions [database]\n"); return 2; } $this->writeMetadata($store->getMetadata(), $store->isUsingBundled() ? 'embedded' : 'cached'); return 0; } private function rules($command, array $arguments) { $rules = new LocalDefinitionSource(); if ($command === 'list') { foreach ($rules->getDisabledRules() as $rule) { echo $rule . PHP_EOL; } return 0; } if ($command === 'disable' && isset($arguments[0])) { $rules->disable($arguments[0]); return 0; } if ($command === 'enable' && isset($arguments[0])) { $rules->enable($arguments[0]); return 0; } if ($command === 'show' && isset($arguments[0])) { $rule = $arguments[0]; echo json_encode([ 'id' => $rule, 'disabled' => in_array($rule, $rules->getDisabledRules(), true), ], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES) . PHP_EOL; return 0; } if ($command === 'validate') { $rules->merge([ 'signatures' => ['schemaVersion' => 1, 'domains' => [], 'raw' => [], 'regex' => []], 'exploits' => ['schemaVersion' => 1, 'default' => [], 'liteOverrides' => [], 'liteExclusions' => []], 'functions' => ['schemaVersion' => 1, 'default' => [], 'dangerous' => []], 'hashes' => ['schemaVersion' => 1, 'knownMalwareSha256' => [str_repeat('0', 64)], 'knownMalwareMd5Prefixes' => ['count' => 1, 'recordHexCharacters' => 8, 'sha256' => hash('sha256', hex2bin('00000000')), 'chunks' => ['00000000']], 'legacyCoreSha256' => ['count' => 1, 'recordHexCharacters' => 64, 'sha256' => hash('sha256', hex2bin(str_repeat('1', 64))), 'chunks' => [str_repeat('1', 64)]]], ]); return 0; } fwrite(STDERR, "Usage: amwscan rules [exploit:]\n"); return 2; } private function writeMetadata(array $metadata, $source = 'archive') { echo 'Engine version: ' . Scanner::getVersion() . PHP_EOL; echo 'Definition version: ' . $metadata['version'] . PHP_EOL; echo 'Definition sequence: ' . $metadata['sequence'] . PHP_EOL; echo 'Schema version: ' . $metadata['schemaVersion'] . PHP_EOL; echo 'Source: ' . $source . PHP_EOL; echo 'Signature: unsigned' . PHP_EOL; echo 'Update endpoint: ' . ($source === 'archive' ? 'not applicable' : 'configured by environment or scan option') . PHP_EOL; } } run(); if ($report === false) { return 2; } $hasMalware = is_object($report) && isset($report->detected) && $report->detected > 0; $hasFindings = is_object($report) && isset($report->findings) && is_array($report->findings) && count(array_filter($report->findings, static function ($finding) { return !isset($finding['kind'], $finding['severity']) || !in_array($finding['kind'], ['keyword', 'encoded-function-candidate', 'exploit-candidate'], true) || $finding['severity'] !== 'info'; })) > 0; return $hasMalware || $hasFindings ? 1 : 0; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Console; /** * Class Flag. */ class Flag { /** * @var string */ public $name; /** * @var null */ public $callback; /** * @var array */ public $aliases = []; /** * @var bool */ public $hasValue = false; /** * @var string */ public $valueName; public $defaultValue; public $var; public $help; /** * Flag constructor. * * @param array $options * @param null $callback */ public function __construct($name, $options = [], $callback = null) { $this->name = $name; $this->callback = $callback; $this->aliases = array_merge(["--$name"], (array)@$options['alias']); $this->defaultValue = @$options['default']; $this->hasValue = (bool)@$options['has_value']; $this->valueName = @$options['value_name']; $this->help = @$options['help']; if (array_key_exists('var', $options)) { $this->var = &$options['var']; } } /** * @return string */ public function __toString() { $s = implode('|', $this->aliases); if ($this->hasValue) { $name = empty($this->valueName) ? $this->name : $this->valueName; $s = "$s <{$name}>"; } return "[$s]"; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Filesystem; class Path { /** * Clean path. * * @return string */ public static function get($path) { $path = trim($path); $path = str_replace(['/', '\\'], DIRECTORY_SEPARATOR, $path); return preg_replace('/' . preg_quote(DIRECTORY_SEPARATOR, '/') . '+/', DIRECTORY_SEPARATOR, $path); } /** * Return real current filename. * * @return string|string[]|null */ public static function getCurrent() { if (strlen(\Phar::running()) > 0) { return \Phar::running(false); } $string = pathinfo('index.php'); $dir = parse_url($string['dirname'] . '/' . $string['basename']); return realpath($dir['path']); } /** * Return real current path. * * @return string|string[]|null */ public static function getCurrentDir() { return dirname(self::getCurrent()); } /** * Get filesize. * * @param int $dec * * @return string */ public static function getFilesize($filePath, $dec = 2) { $bytes = filesize($filePath); $size = ['B', 'kB', 'MB', 'GB', 'TB', 'PB', 'EB', 'ZB', 'YB']; $factor = floor((strlen($bytes) - 1) / 3); return sprintf("%.{$dec}f", $bytes / pow(1024, $factor)) . ' ' . @$size[$factor]; } /** * Convert to Bytes. * * @param string $from * * @return int|null */ public static function sizeToBytes($from) { $units = ['B', 'KB', 'MB', 'GB', 'TB', 'PB']; $number = substr($from, 0, -2); $suffix = strtoupper(substr($from, -2)); if (is_numeric($suffix[0])) { return preg_replace('/\D/', '', $from); } $pow = array_flip($units)[$suffix] ?: null; if ($pow === null) { return null; } return $number * pow(1024, $pow); } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Filesystem; use AMWScan\Scan\Scanner; class Cache { protected static $instance; /** * Cache. * * @var array */ protected static $cache = []; /** * Cache file extension. * * @var string */ protected static $ext = 'cache'; /** * Temp dir. * * @var string */ protected $tempdir; /** * Cache constructor. */ protected function __construct() { $userIdentifier = function_exists('posix_getuid') ? (string)posix_getuid() : md5(get_current_user()); $tempdir = sys_get_temp_dir() . DIRECTORY_SEPARATOR . Scanner::getLowerName() . DIRECTORY_SEPARATOR . $userIdentifier . DIRECTORY_SEPARATOR . 'cache' . DIRECTORY_SEPARATOR; $cacheDirectory = rtrim($tempdir, DIRECTORY_SEPARATOR); if (!is_dir($tempdir) && (!mkdir($tempdir, 0700, true) && !is_dir($tempdir))) { throw new \RuntimeException(sprintf('Temp Directory "%s" was not created', $tempdir)); } if (is_link($cacheDirectory)) { throw new \RuntimeException(sprintf('Cache Directory "%s" must not be a symbolic link', $tempdir)); } if (function_exists('posix_getuid') && function_exists('fileowner') && fileowner($cacheDirectory) !== posix_getuid()) { throw new \RuntimeException(sprintf('Cache Directory "%s" is owned by another user', $tempdir)); } if (DIRECTORY_SEPARATOR !== '\\') { @chmod($cacheDirectory, 0700); } $this->tempdir = $tempdir; } public static function getInstance() { if (static::$instance === null) { static::$instance = new static(); } return static::$instance; } private function __clone() { } public function __wakeup() { } /** * Set cache item. * * @param string $key * @param int $ttl * * @return bool */ public function set($key, $value, $ttl = 3600) { $key = $this->key($key); $data = ['ttl' => $ttl > 0 ? time() + $ttl : $ttl, 'data' => $value]; if (!Scanner::isCacheEnabled()) { self::$cache[$key] = $data; return true; } $fileData = json_encode($data); if ($fileData === false) { return false; } $file = $this->tempdir . $key . '.' . self::$ext; $tempFile = tempnam($this->tempdir, $key . '.tmp-'); if ($tempFile === false) { return false; } $written = file_put_contents($tempFile, $fileData, LOCK_EX); if ($written === false) { @unlink($tempFile); return false; } if (DIRECTORY_SEPARATOR !== '\\') { @chmod($tempFile, 0600); } if (!@rename($tempFile, $file)) { if (!is_file($file) || !@unlink($file) || !@rename($tempFile, $file)) { @unlink($tempFile); return false; } } self::$cache[$key] = $data; return true; } /** * Update time to live. * * @param string $key * @param int $ttl * * @return bool */ public function touch($key, $ttl = 3600) { if (!Scanner::isCacheEnabled()) { return true; } if ($data = $this->get($key)) { return $this->set($key, $data, $ttl); } return false; } /** * Get cache item. * * @param string $key */ public function get($key, $default = null) { $key = $this->key($key); $file = $this->tempdir . $key . '.' . self::$ext; $data = false; if (isset(self::$cache[$key])) { $data = self::$cache[$key]; } elseif (Scanner::isCacheEnabled() && is_file($file) && !is_link($file)) { $fileData = file_get_contents($file); if ($fileData !== false) { $data = json_decode($fileData, true); } if (is_array($data)) { self::$cache[$key] = $data; } else { $data = false; $this->deleteItem($file); } } if ($data !== false) { if (!empty($data)) { if (isset($data['ttl']) && is_int($data['ttl']) && array_key_exists('data', $data)) { if ($data['ttl'] <= 0 || $data['ttl'] >= time()) { return $data['data']; } $this->deleteItem($file); } else { $this->deleteItem($file); } } else { $this->deleteItem($file); } } return $default; } /** * Clean cache. * * @return bool */ public function flush() { return $this->deleteRegex(); } /** * Delete cache item. * * @param string $key * * @return bool */ public function delete($key) { $key = $this->key($key); return $this->deleteItem($this->tempdir . $key . '.' . self::$ext); } /** * Delete item cache by regex. * * @param string $pattern * * @return bool */ public function deleteRegex($pattern = '*') { $return = true; foreach (glob($this->tempdir . $pattern, GLOB_NOSORT | GLOB_BRACE) as $cacheFile) { if (!$this->deleteItem($cacheFile)) { $return = false; } } return $return; } /** * Generate key. * * @see https://stackoverflow.com/a/42058764 * * @param string $key * * @return string */ protected function key($key) { $filename = preg_replace( '~' . '[<>:"/\\|?*]|' . // file system reserved https://en.wikipedia.org/wiki/Filename#Reserved_characters_and_words '[\x00-\x1F]|' . // control characters http://msdn.microsoft.com/en-us/library/windows/desktop/aa365247%28v=vs.85%29.aspx '[\x7F\xA0\xAD]|' . // non-printing characters DEL, NO-BREAK SPACE, SOFT HYPHEN '[#\[\]@!$&\'()+,;=]|' . // URI reserved https://tools.ietf.org/html/rfc3986#section-2.2 '[{}^\~`]' . // URL unsafe characters https://www.ietf.org/rfc/rfc1738.txt '~x', '-', $key ); // avoids ".", ".." or ".hiddenFiles" $filename = ltrim($filename, '.-'); // maximize filename length to 255 bytes http://serverfault.com/a/9548/44086 // reduce consecutive characters $filename = preg_replace([ '/ +/', // "file name.zip" becomes "file-name.zip" '/_+/', // "file___name.zip" becomes "file-name.zip" '/-+/', // "file---name.zip" becomes "file-name.zip" ], '-', $filename); $filename = preg_replace([ '/-*\.-*/', // "file--.--.-.--name.zip" becomes "file.name.zip" '/\.{2,}/', // "file...name..zip" becomes "file.name.zip" ], '.', $filename); // lowercase for windows/unix interoperability http://support.microsoft.com/kb/100625 $encoding = mb_detect_encoding($filename); $encoding = ($encoding && $encoding !== 'AUTO') ? $encoding : 'UTF-8'; $filename = mb_strtolower($filename, $encoding); // ".file-name.-" becomes "file-name" $filename = trim($filename, '.-'); $ext = pathinfo($filename, PATHINFO_EXTENSION); $encoding = mb_detect_encoding($filename); $encoding = ($encoding && $encoding !== 'AUTO') ? $encoding : 'UTF-8'; $filename = mb_strcut(pathinfo($filename, PATHINFO_FILENAME), 0, 255 - ($ext !== '' ? strlen($ext) + 1 : 0), $encoding) . ($ext !== '' ? '.' . $ext : ''); return trim($filename, '.-_'); } /** * Delete a item. * * @param string $item * * @return bool */ private function deleteItem($item) { $key = preg_replace('/\.' . preg_quote(self::$ext, '/') . '$/', '', basename($item)); unset(self::$cache[$key]); clearstatcache(true, $item); if (file_exists($item)) { if (!unlink($item)) { return file_put_contents($item, '') !== false; } clearstatcache(true, $item); } return true; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Filesystem; class ResourceLocator { private $root; public function __construct($root = null) { $defaultRoot = \Phar::running() === '' ? dirname(__DIR__, 2) : 'phar://' . \Phar::running(false); $this->root = rtrim((string)($root ?: $defaultRoot), '/\\'); } public function getSourceDirectory() { return $this->root . DIRECTORY_SEPARATOR . 'definitions' . DIRECTORY_SEPARATOR . 'src'; } public function getBundledDatabasePath() { return $this->root . DIRECTORY_SEPARATOR . 'resources' . DIRECTORY_SEPARATOR . 'definitions' . DIRECTORY_SEPARATOR . 'definitions.amwdb'; } public function getTemplatePath($name) { return $this->root . DIRECTORY_SEPARATOR . 'resources' . DIRECTORY_SEPARATOR . 'templates' . DIRECTORY_SEPARATOR . basename($name); } public function getConsoleFontsDirectory() { return $this->root . DIRECTORY_SEPARATOR . 'resources' . DIRECTORY_SEPARATOR . 'console' . DIRECTORY_SEPARATOR . 'fonts'; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Reporting; use AMWScan\Detection\CodeMatch; use AMWScan\Filesystem\Path; use AMWScan\Filesystem\ResourceLocator; use AMWScan\Platform\Platform; use AMWScan\Remediation\Actions; use AMWScan\Scan\Scanner; class Report { /** * @var string */ protected $dateFormat = 'Y-m-d H:i:s'; /** * @var string */ protected $dateFileFormat = 'Ymd-His'; /** * @var array */ protected $data; /** * @var string[] */ protected $formatsText = ['text', 'txt', 'log', 'logs']; /** * @var string[] */ protected $formatsHTML = ['html', 'htm']; /** * @var string[] */ protected $formatsJSON = ['json']; /** * @var string[] */ protected $formatsSARIF = ['sarif']; /** * @param array $data */ public function setData($data) { $this->data = $data; } /** * Save report. * * @param string $filename * @param string $format * * @return string */ public function save($filename, $format = 'html') { $scanBasename = basename(Scanner::getPathScan()); $scanBasename = strtolower($scanBasename); $scanBasename = str_replace('_', '-', $scanBasename); $filename = str_replace( [ '{DATE}', '{DIRNAME}', ], [ date($this->dateFileFormat), $scanBasename, ], $filename ); // Textual report if (in_array($format, $this->formatsText)) { if (!preg_match('/[\S][.](' . implode('|', $this->formatsText) . ')$/', $filename)) { $filename .= '.log'; } return $this->saveText($filename); } if (in_array($format, $this->formatsJSON, true)) { if (!preg_match('/\.json$/i', $filename)) { $filename .= '.json'; } return $this->saveJSON($filename); } if (in_array($format, $this->formatsSARIF, true)) { if (!preg_match('/\.sarif$/i', $filename)) { $filename .= '.sarif'; } return $this->saveSARIF($filename); } // Html report if (in_array($format, $this->formatsHTML) && !preg_match('/[\S][.](' . implode('|', $this->formatsHTML) . ')$/', $filename)) { $filename .= '.html'; } // Default return $this->saveHTML($filename); } /** * Save report with html format. * * @param string $filename * * @return string */ protected function saveHTML($filename) { $content = $this->renderHTML(); Actions::putContents($filename, $content); return $filename; } /** * Render the complete HTML report without writing it to disk. * * @return string */ public function renderHTML() { $template = (new ResourceLocator())->getTemplatePath('Report.html'); $content = file_get_contents($template); if ($content === false) { throw new \RuntimeException(sprintf('Unable to read report template "%s".', $template)); } $categorizedResults = $this->categorizeLegacyResults( isset($this->data['results']) && is_array($this->data['results']) ? $this->data['results'] : [] ); $malwareResults = $categorizedResults['malware']; $mainContent = ''; if (!empty($malwareResults)) { uksort($malwareResults, function ($leftPath, $rightPath) use (&$malwareResults) { $priority = $this->severityPriority($this->legacyResultsSeverity([$malwareResults[$rightPath]])) <=> $this->severityPriority($this->legacyResultsSeverity([$malwareResults[$leftPath]])); return $priority !== 0 ? $priority : strcmp($leftPath, $rightPath); }); $mainTable = new Table('report', 'datatable container table table-bordered'); $num = 0; foreach ($malwareResults as $filePath => $items) { usort($items, function ($left, $right) { $priority = $this->severityPriority(isset($right['level']) ? $right['level'] : '') <=> $this->severityPriority(isset($left['level']) ? $left['level'] : ''); return $priority !== 0 ? $priority : strcmp( isset($left['key']) ? (string)$left['key'] : '', isset($right['key']) ? (string)$right['key'] : '' ); }); $hasAiReviews = count(array_filter($items, static function ($item) { return is_array($item) && !empty($item['ai_review']) && is_array($item['ai_review']); })) > 0; $header = ['Description', 'Match']; if ($hasAiReviews) { $header[] = 'AI review'; } $dangerous = 0; $warnings = 0; $rows = []; foreach ($items as $item) { $badges = []; if (!empty($item['line'])) { $badges[] = 'Line: ' . $item['line'] . ''; } if (!empty($item['level'])) { switch ($item['level']) { case CodeMatch::WARNING: $warnings++; $badges[] = 'Warning'; break; case CodeMatch::DANGEROUS: $dangerous++; $badges[] = 'Dangerous'; break; } } $description = '-'; if (isset($item['description'])) { $description = '

' . htmlentities($item['description']) . '

'; if (isset($item['link'])) { $links = explode(',', $item['link']); foreach ($links as $key => $link) { $link = trim($link); $escapedLink = $this->escape($link); $scheme = parse_url($link, PHP_URL_SCHEME); if (filter_var($link, FILTER_VALIDATE_URL) && in_array(strtolower((string)$scheme), ['http', 'https'], true)) { $links[$key] = '' . $escapedLink . ''; } else { $links[$key] = $escapedLink; } } $description .= '

' . implode(', ', $links) . '

'; } } $maxLength = 500; $match = trim($item['match']); $match = strlen($match) > $maxLength ? substr($match, 0, $maxLength) . '...' : $match; $match = highlight_string(' 'syntax-default', 'highlight.keyword' => 'syntax-keyword', 'highlight.string' => 'syntax-string', 'highlight.comment' => 'syntax-comment', 'highlight.html' => 'syntax-html', ]; foreach ($syntaxColors as $setting => $class) { $match = str_replace('style="color: ' . ini_get($setting) . '"', 'class="' . $class . '"', $match); } $match = preg_replace('/<\?php(?: |\s)*/', '', $match, 1); $row = [ '

' . ucfirst($item['type']) . ' ' . htmlentities($item['key']) . ' ' . implode(' ', $badges) . '

' . $description, '' . $match . '', ]; if ($hasAiReviews) { $row[] = $this->aiReviewHTML(isset($item['ai_review']) && is_array($item['ai_review']) ? $item['ai_review'] : null); } $rows[] = $row; } usort($rows, function ($item1, $item2) { if ($item1[0] === $item2[0]) { return 0; } return $item1[0] < $item2[0] ? -1 : 1; }); $table = new Table('file_' . $num, 'finding-table' . ($hasAiReviews ? ' has-ai-review' : '')); $table->setHeader($header); $table->setData($rows); $tableContent = $table->getHTML(); $fileSize = is_file($filePath) ? Path::getFilesize($filePath) : 'Unavailable'; $fileCreateDate = is_file($filePath) ? date($this->dateFormat, filemtime($filePath)) : 'Unavailable'; $fileModifiedDate = is_file($filePath) ? date($this->dateFormat, filectime($filePath)) : 'Unavailable'; $badges = []; $badges[] = 'Size: ' . $fileSize . ''; $badges[] = 'Created: ' . $fileCreateDate . ''; $badges[] = 'Modified: ' . $fileModifiedDate . ''; if ($warnings > 0) { $badges[] = 'Warnings: ' . $warnings . ''; } if ($dangerous > 0) { $badges[] = 'Dangers: ' . $dangerous . ''; } $tableId = 'file_' . $num; $rowContent = ''; $rowContent .= '
' . implode(' ', $badges) . '
' . $tableContent; $mainTable->addRow([$rowContent]); $num++; } $mainContent = $this->panelHTML( 'malware', 'Malware', 'ti-shield-exclamation', count($malwareResults), $mainTable->getHTML(), $this->legacyResultsSeverity($malwareResults), true ); } $supportingContent = $this->supportingPanelsHTML( $categorizedResults['large-files'], isset($this->data['findings']) && is_array($this->data['findings']) ? $this->data['findings'] : [], isset($this->data['wordpressDatabase']) && is_array($this->data['wordpressDatabase']) ? $this->data['wordpressDatabase'] : [] ); if ($mainContent === '' && $supportingContent === '') { $mainContent = '

No findings detected

No suspicious files or platform issues were detected during this scan.

'; } else { $mainContent = '
' . $supportingContent . $mainContent . '
'; } $content = str_replace( [ '{VERSION}', '{DATE}', '{COUNT}', '{INFECTED}', '{CONTENTS}', '{VERIFIED_BY_CHECKSUM}', '{PLATFORM_INFO}', '{WORDPRESS_DATABASE}', ], [ Scanner::getVersion(), date($this->dateFormat), $this->data['scanned'], count($malwareResults), $mainContent, $this->data['verifiedByChecksum'] ?? 0, (new Platform())->reportHTML($this->data), '', ], $content ); return $content; } private function categorizeLegacyResults(array $results) { $categorized = ['malware' => [], 'large-files' => []]; foreach ($results as $filePath => $items) { foreach ((array)$items as $item) { $category = isset($item['key']) && $item['key'] === 'oversized_script_file' ? 'large-files' : 'malware'; if (!isset($categorized[$category][$filePath])) { $categorized[$category][$filePath] = []; } $categorized[$category][$filePath][] = $item; } } return $categorized; } private function groupSupportingFindings(array $findings) { $groups = []; foreach ($findings as $finding) { if (!is_array($finding)) { continue; } $kind = isset($finding['kind']) ? $finding['kind'] : 'recommendations'; if ($kind === 'malware') { continue; } if (!in_array($kind, ['integrity', 'database', 'reputation'], true)) { $kind = 'recommendations'; } if (!isset($groups[$kind])) { $groups[$kind] = []; } $groups[$kind][] = $finding; } return $groups; } private function supportingPanelsHTML(array $largeFiles, array $findings, array $databaseReport) { $groups = $this->groupSupportingFindings($findings); $panels = []; if (!empty($largeFiles)) { $panels[] = [ 'priority' => $this->severityPriority($this->legacyResultsSeverity($largeFiles)), 'order' => 3, 'html' => $this->panelHTML('large-files', 'Large files', 'ti-file-alert', count($largeFiles), $this->largeFilesHTML($largeFiles), $this->legacyResultsSeverity($largeFiles)), ]; } $categoryDefinitions = [ 'integrity' => ['Integrity findings', 'ti-fingerprint', 0], 'reputation' => ['Suspicious domains and reputation', 'ti-world-exclamation', 2], 'recommendations' => ['Recommendations and warnings', 'ti-alert-circle', 4], ]; foreach ($groups as $kind => $categoryFindings) { if ($kind === 'database') { continue; } usort($categoryFindings, function ($left, $right) { $priority = $this->severityPriority(isset($right['severity']) ? $right['severity'] : '') <=> $this->severityPriority(isset($left['severity']) ? $left['severity'] : ''); return $priority !== 0 ? $priority : strcmp( isset($left['subject']) ? (string)$left['subject'] : '', isset($right['subject']) ? (string)$right['subject'] : '' ); }); $definition = isset($categoryDefinitions[$kind]) ? $categoryDefinitions[$kind] : ['Other findings', 'ti-alert-circle']; $severity = isset($categoryFindings[0]['severity']) ? $categoryFindings[0]['severity'] : 'info'; $slug = isset($categoryDefinitions[$kind]) ? $kind : 'other'; $featured = $slug === 'recommendations'; $panels[] = [ 'priority' => $this->severityPriority($severity), 'order' => isset($definition[2]) ? $definition[2] : 5, 'featured' => $featured, 'html' => $this->panelHTML($slug, $definition[0], $definition[1], count($categoryFindings), $this->canonicalFindingsHTML($categoryFindings), $severity, $featured), ]; } $databasePanel = $this->databasePanelHTML( $databaseReport, isset($groups['database']) ? $groups['database'] : [] ); if ($databasePanel !== null) { $panels[] = $databasePanel; } if (empty($panels)) { return ''; } usort($panels, static function ($left, $right) { $featured = (isset($right['featured']) ? (int)$right['featured'] : 0) <=> (isset($left['featured']) ? (int)$left['featured'] : 0); if ($featured !== 0) { return $featured; } $priority = $right['priority'] <=> $left['priority']; return $priority !== 0 ? $priority : $left['order'] <=> $right['order']; }); $regularCount = count(array_filter($panels, static function ($panel) { return empty($panel['featured']); })); $regularIndex = 0; foreach ($panels as &$panel) { if (!empty($panel['featured'])) { continue; } $isLastOdd = $regularCount % 2 === 1 && $regularIndex === $regularCount - 1; $size = $isLastOdd || $regularIndex % 4 === 0 || $regularIndex % 4 === 3 ? 'wide' : 'narrow'; if ($isLastOdd) { $size = 'full'; } $panel['html'] = preg_replace('/class="finding-panel /', 'class="finding-panel finding-panel--' . $size . ' ', $panel['html'], 1); $regularIndex++; } unset($panel); return '
' . implode('', array_column($panels, 'html')) . '
'; } private function panelHTML($slug, $title, $icon, $count, $body, $severity, $fullWidth = false) { $severity = $this->normalizedSeverity($severity); $classes = 'finding-panel finding-panel--' . $this->escape($slug) . ($fullWidth ? ' finding-panel--full' : ''); return '
' . '' . 'Finding category

' . $this->escape($title) . '

' . '' . $this->escape(ucfirst($severity)) . '' . '' . (int)$count . '' . '
' . $body . '
'; } private function canonicalFindingsHTML(array $findings) { $content = '
'; foreach ($findings as $finding) { $severity = $this->normalizedSeverity(isset($finding['severity']) ? $finding['severity'] : 'info'); $evidence = isset($finding['evidence']) && is_array($finding['evidence']) ? $finding['evidence'] : []; $encodedEvidence = json_encode($evidence, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_INVALID_UTF8_SUBSTITUTE); $content .= '
' . '
' . $this->escape(isset($finding['rule_id']) ? $finding['rule_id'] : 'finding') . '' . '' . $this->escape(ucfirst($severity)) . '
' . '

' . $this->escape(isset($finding['subject']) ? $finding['subject'] : '') . '

' . '

' . $this->escape(isset($finding['message']) ? $finding['message'] : '') . '

'; if (!empty($evidence)) { $content .= '
Evidence
' . $this->escape($encodedEvidence ?: '{}') . '
'; } $content .= '
'; } return $content . '
'; } private function largeFilesHTML(array $files) { $entries = []; foreach ($files as $filePath => $items) { foreach ($items as $item) { $entries[] = ['path' => $filePath, 'item' => $item]; } } usort($entries, function ($left, $right) { $priority = $this->severityPriority(isset($right['item']['level']) ? $right['item']['level'] : '') <=> $this->severityPriority(isset($left['item']['level']) ? $left['item']['level'] : ''); return $priority !== 0 ? $priority : strcmp($left['path'], $right['path']); }); $content = '
'; foreach ($entries as $entry) { $item = $entry['item']; $severity = $this->normalizedSeverity(isset($item['level']) ? $item['level'] : 'warning'); $content .= '
' . '
oversized_script_file' . $this->escape(ucfirst($severity)) . '
' . '

' . $this->escape($entry['path']) . '

' . $this->escape(isset($item['description']) ? $item['description'] : 'The script exceeds the configured size threshold.') . '

' . '
'; } return $content . '
'; } private function databaseReportSummary(array $report, $severity) { $count = count(isset($report['coverage']['errors']) ? (array)$report['coverage']['errors'] : []); if ($count > 0) { $severity = 'danger'; } foreach (isset($report['targets']) ? (array)$report['targets'] : [] as $target) { $findings = isset($target['findings']) ? (array)$target['findings'] : []; $count += count($findings); foreach ($findings as $finding) { if (is_array($finding) && isset($finding['severity']) && $this->severityPriority($finding['severity']) > $this->severityPriority($severity)) { $severity = $finding['severity']; } } $errors = count(isset($target['coverage']['errors']) ? (array)$target['coverage']['errors'] : []); $count += $errors; if ($errors > 0) { $severity = 'danger'; } } return [$count, $severity]; } private function databasePanelHTML(array $report, array $canonicalFindings = []) { usort($canonicalFindings, function ($left, $right) { $priority = $this->severityPriority(isset($right['severity']) ? $right['severity'] : '') <=> $this->severityPriority(isset($left['severity']) ? $left['severity'] : ''); return $priority !== 0 ? $priority : strcmp( isset($left['subject']) ? (string)$left['subject'] : '', isset($right['subject']) ? (string)$right['subject'] : '' ); }); $count = count($canonicalFindings); $severity = $count > 0 && isset($canonicalFindings[0]['severity']) ? $canonicalFindings[0]['severity'] : 'info'; list($reportCount, $severity) = $this->databaseReportSummary($report, $severity); $count += $reportCount; if ($count === 0) { return null; } $body = $canonicalFindings === [] ? '' : $this->canonicalFindingsHTML($canonicalFindings); if ($reportCount > 0) { $body .= (new Platform())->reportSection('database', $this->data, 'html'); } return [ 'priority' => $this->severityPriority($severity), 'order' => 1, 'html' => $this->panelHTML('database', 'Database findings', 'ti-database', $count, $body, $severity), ]; } private function legacyResultsSeverity(array $results) { $severity = 'info'; foreach ($results as $items) { foreach ($items as $item) { $candidate = isset($item['level']) ? $item['level'] : 'info'; if ($this->severityPriority($candidate) > $this->severityPriority($severity)) { $severity = $candidate; } } } return $severity; } private function normalizedSeverity($severity) { $severity = strtolower((string)$severity); if (in_array($severity, ['critical', 'dangerous', 'danger', 'high', (string)CodeMatch::DANGEROUS], true)) { return 'danger'; } if (in_array($severity, ['warning', 'warn', 'medium', (string)CodeMatch::WARNING], true)) { return 'warning'; } return 'secondary'; } private function severityPriority($severity) { $severity = strtolower((string)$severity); if (in_array($severity, ['critical', 'dangerous', 'danger', (string)CodeMatch::DANGEROUS], true)) { return 4; } if ($severity === 'high') { return 3; } return $this->normalizedSeverity($severity) === 'warning' ? 2 : 1; } /** * Save report with text format. * * @param string $filename * * @return string */ protected function saveText($filename) { $content = $this->generateText(); Actions::putContents($filename, $content); return $filename; } /** * Generate report with text format. * * @return string */ protected function generateText() { $content = "PHP Antimalware Scanner Report\n"; $content .= 'Version: ' . Scanner::getVersion() . "\n"; $content .= 'Date: ' . date($this->dateFormat) . "\n"; $content .= 'Total files scanned: ' . $this->data['scanned'] . "\n"; $content .= 'Verified by checksum: ' . $this->data['verifiedByChecksum'] . "\n"; $content .= 'Infected files: ' . count($this->data['results']) . "\n\n"; if (empty($this->data['results'])) { $content .= "No malware found!\n"; } else { foreach ($this->data['results'] as $filePath => $items) { $content .= $this->fileText($filePath, $items); } } $content .= "\n" . (new Platform())->reportSection('database', $this->data, 'text'); $content .= "\n" . (new Platform())->reportText($this->data); return $content; } private function fileText($filePath, $items) { $levels = $this->countTextLevels($items); $content = 'File: ' . $filePath . "\n"; $content .= ' Size: ' . Path::getFilesize($filePath) . "\n"; $content .= ' Modified: ' . date($this->dateFormat, filemtime($filePath)) . "\n"; if ($levels['warnings'] > 0) { $content .= ' Warnings: ' . $levels['warnings'] . "\n"; } if ($levels['dangerous'] > 0) { $content .= ' Dangers: ' . $levels['dangerous'] . "\n"; } $content .= "\n"; foreach ($items as $item) { $content .= $this->findingText($item); } return $content . "\n"; } private function countTextLevels($items) { $levels = ['warnings' => 0, 'dangerous' => 0]; foreach ($items as $item) { if (!isset($item['level'])) { continue; } if ($item['level'] === CodeMatch::WARNING) { $levels['warnings']++; } elseif ($item['level'] === CodeMatch::DANGEROUS) { $levels['dangerous']++; } } return $levels; } private function findingText($item) { $badges = []; if (!empty($item['line'])) { $badges[] = 'Line: ' . $item['line']; } if (isset($item['level']) && $item['level'] === CodeMatch::WARNING) { $badges[] = 'Warning'; } elseif (isset($item['level']) && $item['level'] === CodeMatch::DANGEROUS) { $badges[] = 'Dangerous'; } $description = isset($item['description']) ? $item['description'] : ''; if ($description !== '' && isset($item['link'])) { $description .= ' [' . implode(', ', explode(',', $item['link'])) . ']'; } $maxLength = 500; $match = trim($item['match']); $match = strlen($match) > $maxLength ? substr($match, 0, $maxLength) . '...' : $match; $content = ' - ' . ucfirst($item['type']) . ' ' . $item['key']; if (!empty($badges)) { $content .= ' [' . implode(', ', $badges) . ']'; } $content .= "\n"; if ($description !== '') { $content .= ' Description: ' . $description . "\n"; } if (!empty($item['ai_review']) && is_array($item['ai_review'])) { $review = $item['ai_review']; $completed = !isset($review['status']) || $review['status'] === 'completed'; $label = $completed && isset($review['verdict']) ? $review['verdict'] : (isset($review['status']) ? $review['status'] : 'failed'); $message = $completed && isset($review['reason']) ? $review['reason'] : (isset($review['message']) ? $review['message'] : 'AI review failed.'); $confidence = $completed && isset($review['confidence']) ? ' (' . (int)round($review['confidence'] * 100) . '% confidence)' : ''; $provider = isset($review['provider']) ? $review['provider'] : ''; $model = isset($review['model']) && $review['model'] !== '' ? ' / ' . $review['model'] : ''; $content .= ' AI review: ' . ucwords(str_replace('_', ' ', $label)) . $confidence . "\n"; $content .= ' AI reason: ' . $message . "\n"; if ($provider !== '') { $content .= ' AI provider: ' . $provider . $model . "\n"; } } return $content . ' Match: ' . $match . "\n\n"; } private function aiReviewHTML($review) { if ($review === null) { return 'Not analyzed'; } $completed = !isset($review['status']) || $review['status'] === 'completed'; $label = $completed && isset($review['verdict']) ? $review['verdict'] : (isset($review['status']) ? $review['status'] : 'failed'); $message = $completed && isset($review['reason']) ? $review['reason'] : (isset($review['message']) ? $review['message'] : 'AI review failed.'); $confidence = $completed && isset($review['confidence']) ? ' - ' . (int)round($review['confidence'] * 100) . '%' : ''; $provider = isset($review['provider']) ? $review['provider'] : ''; $model = isset($review['model']) && $review['model'] !== '' ? ' / ' . $review['model'] : ''; $class = $label === 'malware' ? 'danger' : ($label === 'false_positive' ? 'success' : 'warning'); $content = '
AI: ' . $this->escape(ucwords(str_replace('_', ' ', $label))) . $confidence . ''; $content .= '

' . $this->escape($message) . '

'; if ($provider !== '') { $content .= '' . $this->escape($provider . $model) . ''; } return $content . '
'; } private function escape($value) { return htmlentities((string)$value, ENT_QUOTES, 'UTF-8'); } /** * Save the complete report as JSON. * * @param string $filename * * @return string */ protected function saveJSON($filename) { $json = json_encode( $this->data['report'], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_INVALID_UTF8_SUBSTITUTE ); if (!is_string($json) || Actions::putContents($filename, $json) === false) { throw new \RuntimeException(sprintf('Unable to write JSON report "%s".', $filename)); } return $filename; } /** * Save canonical findings as SARIF 2.1.0. * * @param string $filename * * @return string */ protected function saveSARIF($filename) { $report = $this->data['report']; $rules = []; $results = []; foreach (isset($report['findings']) ? $report['findings'] : [] as $finding) { if (!is_array($finding) || empty($finding['rule_id'])) { continue; } $ruleId = (string)$finding['rule_id']; $rules[$ruleId] = [ 'id' => $ruleId, 'shortDescription' => ['text' => isset($finding['message']) ? (string)$finding['message'] : $ruleId], 'properties' => [ 'kind' => isset($finding['kind']) ? $finding['kind'] : '', 'provider' => isset($finding['provider']) ? $finding['provider'] : '', ], ]; $location = [ 'physicalLocation' => [ 'artifactLocation' => ['uri' => $this->sarifUri(isset($finding['subject']) ? $finding['subject'] : '')], ], ]; if (!empty($finding['evidence']['line'])) { $location['physicalLocation']['region'] = ['startLine' => (int)$finding['evidence']['line']]; } $results[] = [ 'ruleId' => $ruleId, 'level' => $this->sarifLevel(isset($finding['severity']) ? $finding['severity'] : ''), 'message' => ['text' => isset($finding['message']) ? (string)$finding['message'] : $ruleId], 'locations' => [$location], 'properties' => [ 'findingId' => isset($finding['id']) ? $finding['id'] : '', 'status' => isset($finding['status']) ? $finding['status'] : 'open', 'evidence' => isset($finding['evidence']) ? $finding['evidence'] : [], ], ]; } $sarif = [ '$schema' => 'https://json.schemastore.org/sarif-2.1.0.json', 'version' => '2.1.0', 'runs' => [[ 'tool' => ['driver' => [ 'name' => Scanner::getFullName(), 'version' => Scanner::getVersion(), 'rules' => array_values($rules), ]], 'results' => $results, 'properties' => [ 'coverage' => isset($report['coverage']) ? $report['coverage'] : [], 'signatureIndexes' => isset($report['signature_indexes']) ? $report['signature_indexes'] : [], 'inventory' => isset($report['inventory']) ? $report['inventory'] : [], 'diagnostics' => isset($report['diagnostics']) ? $report['diagnostics'] : [], ], ]], ]; $json = json_encode($sarif, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_INVALID_UTF8_SUBSTITUTE); if (!is_string($json) || Actions::putContents($filename, $json) === false) { throw new \RuntimeException(sprintf('Unable to write SARIF report "%s".', $filename)); } return $filename; } private function sarifLevel($severity) { if (in_array(strtolower((string)$severity), ['danger', 'critical', 'high'], true)) { return 'error'; } if (in_array(strtolower((string)$severity), ['warn', 'warning', 'medium'], true)) { return 'warning'; } return 'note'; } private function sarifUri($subject) { $subject = str_replace('\\', '/', (string)$subject); if (preg_match('~^[a-z][a-z0-9+.-]*://~i', $subject)) { return $subject; } $segments = array_map('rawurlencode', explode('/', $subject)); if (isset($segments[0]) && preg_match('/^[a-z]%3A$/i', $segments[0])) { $segments[0] = substr($segments[0], 0, 1) . ':'; return 'file:///' . implode('/', $segments); } if (strpos($subject, '/') === 0) { return 'file://' . implode('/', $segments); } return implode('/', $segments); } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Reporting; class Table { /** * @var string */ private $tableId; /** * @var string */ private $tableClass; /** * @var string */ private $headerId; /** * @var string */ private $headerClass; /** * @var bool */ private $isDatatable; /** * @var array */ private $data = []; /** * @var array */ private $header = []; /** * Constructor for table class. * * @param string $id id name for this table * @param string $class class name for this table * @param bool $isDatatable is datatable */ public function __construct($id, $class = null, $isDatatable = false) { $this->tableId = $id; if ($class !== null) { $this->tableClass = "class=\"$class\""; } $this->isDatatable = $isDatatable; } /** * Setter for table class name. * * @param string $class class name */ public function setTableClass($class) { $this->tableClass = "class=\"$class\""; } /** * Setter for table id name. * * @param string $id id name */ public function setTableId($id) { $this->tableId = $id; } /** * Setter for thead class name. * * @param string $class class name */ public function setHeaderClass($class) { $this->headerClass = "class=\"$class\""; } /** * Setter for thead id name. * * @param string $id id name */ public function setHeaderId($id) { $this->headerId = "id=\"$id\""; } /** * @param array $data */ public function setData($data) { $this->data = $data; } /** * @param array $row */ public function addRow($row) { $this->data[] = $row; } /** * @param array $header */ public function setHeader($header) { $this->header = $header; } /** * Get the table html. * * @return string */ public function getHTML() { $table = "tableId\" $this->tableClass>"; if (!empty($this->header)) { $table .= "headerId $this->headerClass>"; foreach ($this->header as $header) { $table .= ""; } $table .= ''; } $table .= ''; foreach ($this->data as $row) { $table .= ''; foreach ($row as $col) { $table .= ""; } $table .= ''; } $table .= '
$header
$col
'; if ($this->isDatatable) { $table .= ''; } return $table; } } * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License * * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner */ namespace AMWScan\Remediation; use AMWScan\Filesystem\Path; use AMWScan\Scan\Scanner; use AMWScan\Scan\Whitelist; class Actions { private const MAXIMUM_DIFF_MATRIX_CELLS = 250000; private const MAXIMUM_LINT_OUTPUT_BYTES = 65536; /** * Atomically replace a file after creating a mandatory backup. * * @return array */ public static function replaceContentsAtomically($filename, $data, $backup = true) { if (!is_string($data)) { throw new \InvalidArgumentException('Replacement contents must be a string.'); } $directory = dirname($filename); if (!is_dir($directory) || !is_writable($directory)) { throw new \RuntimeException(sprintf('Directory "%s" is not writable.', $directory)); } $backupPath = null; $permissions = is_file($filename) ? fileperms($filename) & 0777 : 0644; if ($backup && is_file($filename)) { $backupPath = self::makeBackup($filename); } $temporary = $directory . DIRECTORY_SEPARATOR . '.' . basename($filename) . '.amwscan-' . bin2hex(random_bytes(8)); $handle = @fopen($temporary, 'x+b'); if ($handle === false) { throw new \RuntimeException(sprintf('Unable to create temporary file for "%s".', $filename)); } try { $length = strlen($data); $written = 0; while ($written < $length) { $bytes = fwrite($handle, substr($data, $written)); if ($bytes === false || $bytes === 0) { throw new \RuntimeException(sprintf('Unable to write replacement for "%s".', $filename)); } $written += $bytes; } if (!fflush($handle)) { throw new \RuntimeException(sprintf('Unable to flush replacement for "%s".', $filename)); } if (function_exists('fsync')) { fsync($handle); } } finally { fclose($handle); } @chmod($temporary, $permissions); if (!@rename($temporary, $filename)) { @unlink($temporary); throw new \RuntimeException(sprintf('Unable to atomically replace "%s".', $filename)); } return ['path' => $filename, 'backup' => $backupPath]; } /** * Put contents. * * @param int $flags * @param null $context * * @return false|int */ public static function putContents($filename, $data, $flags = 0, $context = null) { if (Scanner::isBackupEnabled()) { self::makeBackup($filename); } return file_put_contents($filename, $data, $flags, $context); } /** * Clean Evil Code. * * @return string|string[]|null */ public static function cleanEvilCode($code, $patternFound) { foreach ($patternFound as $pattern) { if (!isset($pattern['match']) || $pattern['match'] === '') { continue; } $match = '/' . preg_quote($pattern['match'], '/') . '[ \t]*;?/s'; $code = preg_replace($match, '', $code, 1); } $code = preg_replace('/<\?php[\s\r\n]*\?>/i', '', $code); return $code; } /** * Clean Evil Code Line. * * @return string */ public static function cleanEvilCodeLine($code, $patternFound) { $newLine = strpos($code, "\r\n") !== false ? "\r\n" : (strpos($code, "\n") !== false ? "\n" : "\r"); $lines = preg_split('/\R/', $code); foreach ($patternFound as $pattern) { unset($lines[(int)$pattern['line'] - 1]); } return implode($newLine, $lines); } /** * Delete File. * * @return bool */ public static function deleteFile($file) { if (Scanner::isBackupEnabled()) { self::makeBackup($file); } return self::unlink($file); } /** * Move to Quarantine. * * @return false|string */ public static function moveToQuarantine($file) { $quarantine = Scanner::getPathQuarantine() . DIRECTORY_SEPARATOR . str_replace(realpath(Scanner::getPathScan()), '', realpath($file)); $quarantine = str_replace(['/', '\\'], DIRECTORY_SEPARATOR, $quarantine); if (!is_dir(dirname($quarantine)) && (!mkdir($concurrentDirectory = dirname($quarantine), 0755, true) && !is_dir($concurrentDirectory))) { throw new \RuntimeException(sprintf('Directory "%s" was not created', $concurrentDirectory)); } if (!static::renameFile($file, $quarantine)) { return false; } // When source and destination are on different filesystems, // rename() performs a copy then attempts to unlink the source. // PHP returns true even if the source could not be removed, // so we must verify that the original file is actually gone. if (is_file($file)) { static::unlink($file); if (is_file($file)) { static::unlink($quarantine); return false; } } return $quarantine; } /** * Rename a file. * * @return bool */ protected static function renameFile($source, $destination) { return self::withWritableParent($source, static function () use ($source, $destination) { return self::withWritableParent($destination, static function () use ($source, $destination) { return rename($source, $destination); }); }); } /** * Move to Quarantine. * * @return string */ public static function makeBackup($file) { $scanPath = realpath(Scanner::getPathScan()); if (is_file($scanPath)) { $scanPath = dirname($scanPath); } $backup = Scanner::getPathBackups() . DIRECTORY_SEPARATOR . str_replace($scanPath, '', realpath($file)); $backup = Path::get($backup); if (!is_dir(dirname($backup)) && (!mkdir($concurrentDirectory = dirname($backup), 0755, true) && !is_dir($concurrentDirectory))) { throw new \RuntimeException(sprintf('Directory "%s" was not created', $concurrentDirectory)); } if (!copy($file, $backup)) { throw new \RuntimeException(sprintf('Unable to back up "%s" to "%s".', $file, $backup)); } return $backup; } /** * Add to Whitelist. * * @return false|int */ public static function addToWhitelist($file, $patternFound) { $path = Scanner::getPathWhitelist(); $handle = fopen($path, 'c+'); if ($handle === false || !flock($handle, LOCK_EX)) { if (is_resource($handle)) { fclose($handle); } return false; } rewind($handle); $contents = stream_get_contents($handle); $isCsv = Whitelist::isCsv($path); $whitelist = $contents !== false && $contents !== '' ? Whitelist::decode($contents, $isCsv) : []; if ($whitelist === []) { $whitelist = Scanner::getWhitelist(); } foreach ($patternFound as $key => $pattern) { $exploit = $pattern['key']; $lineNumber = $pattern['line']; $match = $pattern['match']; $fileName = Whitelist::relativePath($file, Scanner::getPathScan()); $key = md5("v2\0" . $exploit . "\0" . $fileName . "\0" . ($lineNumber === null ? 'null' : $lineNumber)); $whitelist[$key] = [ 'file' => $fileName, 'exploit' => $exploit, 'line' => $lineNumber, 'match' => $match, ]; } $encoded = Whitelist::encode($whitelist, $isCsv); if ($encoded === false) { flock($handle, LOCK_UN); fclose($handle); return false; } rewind($handle); ftruncate($handle, 0); $written = fwrite($handle, $encoded); fflush($handle); flock($handle, LOCK_UN); fclose($handle); Scanner::setWhitelist(Whitelist::decode($encoded, $isCsv)); return $written; } /** * Open with VIM. * * @return array */ public static function openWithVim($file, $lineNumber = null) { return static::openEditor('vim', $file, $lineNumber); } /** * Open with Nano. * * @return array */ public static function openWithNano($file, $lineNumber = null) { return static::openEditor('nano', $file, $lineNumber); } /** * @return array */ protected static function openEditor($editor, $file, $lineNumber = null) { $originalContent = file_get_contents($file); if ($originalContent === false) { throw new \RuntimeException(sprintf('Unable to read "%s" before editing.', $file)); } if (Scanner::isBackupEnabled()) { self::makeBackup($file); } $command = [$editor]; if ($lineNumber !== null && is_numeric($lineNumber) && $lineNumber > 0) { $command[] = '+' . (int)$lineNumber; } $command[] = '--'; $command[] = $file; if (!static::runEditor($command)) { throw new \RuntimeException(sprintf('%s exited without saving successfully.', $editor)); } $editedContent = file_get_contents($file); if ($editedContent === false) { throw new \RuntimeException(sprintf('Unable to read "%s" after editing.', $file)); } return [ 'changed' => $originalContent !== $editedContent, 'diff' => static::unifiedDiff($originalContent, $editedContent, $file), ]; } protected static function runEditor(array $command) { $descriptors = [STDIN, STDOUT, STDERR]; $process = proc_open($command, $descriptors, $pipes, null, null, ['bypass_shell' => true]); if (!is_resource($process)) { return false; } return proc_close($process) === 0; } /** * Build a compact unified diff around the changed lines. * * @return string */ public static function unifiedDiff($originalContent, $editedContent, $file = 'file') { if ($originalContent === $editedContent) { return ''; } $originalLines = preg_split('/\R/', $originalContent); $editedLines = preg_split('/\R/', $editedContent); $originalCount = count($originalLines); $editedCount = count($editedLines); $prefix = 0; while ($prefix < $originalCount && $prefix < $editedCount && $originalLines[$prefix] === $editedLines[$prefix]) { $prefix++; } $suffix = 0; while ($suffix < $originalCount - $prefix && $suffix < $editedCount - $prefix && $originalLines[$originalCount - $suffix - 1] === $editedLines[$editedCount - $suffix - 1]) { $suffix++; } $contextStart = max(0, $prefix - 3); $contextSuffix = min(3, $suffix); $originalChangedEnd = $originalCount - $suffix; $editedChangedEnd = $editedCount - $suffix; $originalLength = $originalChangedEnd - $contextStart + $contextSuffix; $editedLength = $editedChangedEnd - $contextStart + $contextSuffix; $displayFile = preg_replace('/[\x00-\x1F\x7F]/', '?', (string)$file); $diff = sprintf( "--- %s (before)\n+++ %s (after)\n@@ -%d,%d +%d,%d @@\n", $displayFile, $displayFile, $contextStart + 1, $originalLength, $contextStart + 1, $editedLength ); for ($index = $contextStart; $index < $prefix; $index++) { $diff .= ' ' . $originalLines[$index] . "\n"; } for ($index = $prefix; $index < $originalChangedEnd; $index++) { $diff .= '-' . $originalLines[$index] . "\n"; } for ($index = $prefix; $index < $editedChangedEnd; $index++) { $diff .= '+' . $editedLines[$index] . "\n"; } for ($index = 0; $index < $contextSuffix; $index++) { $diff .= ' ' . $originalLines[$originalChangedEnd + $index] . "\n"; } return $diff; } /** * Build aligned rows for a side-by-side diff viewer. * * @return array */ public static function sideBySideDiff($originalContent, $editedContent) { if ($originalContent === $editedContent) { return []; } $originalLines = preg_split('/\R/', $originalContent); $editedLines = preg_split('/\R/', $editedContent); $originalCount = count($originalLines); $editedCount = count($editedLines); $prefix = 0; while ($prefix < $originalCount && $prefix < $editedCount && $originalLines[$prefix] === $editedLines[$prefix]) { $prefix++; } $suffix = 0; while ($suffix < $originalCount - $prefix && $suffix < $editedCount - $prefix && $originalLines[$originalCount - $suffix - 1] === $editedLines[$editedCount - $suffix - 1]) { $suffix++; } $rows = []; $contextStart = max(0, $prefix - 3); if ($contextStart > 0) { $rows[] = [ 'type' => 'separator', 'before' => null, 'after' => null, 'label' => sprintf('%d unchanged lines', $contextStart), ]; } for ($index = $contextStart; $index < $prefix; $index++) { $rows[] = [ 'type' => 'context', 'before' => ['number' => $index + 1, 'content' => $originalLines[$index]], 'after' => ['number' => $index + 1, 'content' => $editedLines[$index]], ]; } $originalChangedEnd = $originalCount - $suffix; $editedChangedEnd = $editedCount - $suffix; $rows = array_merge($rows, static::alignChangedLines( array_slice($originalLines, $prefix, $originalChangedEnd - $prefix), array_slice($editedLines, $prefix, $editedChangedEnd - $prefix), $prefix + 1, $prefix + 1 )); $contextSuffix = min(3, $suffix); for ($index = 0; $index < $contextSuffix; $index++) { $originalIndex = $originalChangedEnd + $index; $editedIndex = $editedChangedEnd + $index; $rows[] = [ 'type' => 'context', 'before' => ['number' => $originalIndex + 1, 'content' => $originalLines[$originalIndex]], 'after' => ['number' => $editedIndex + 1, 'content' => $editedLines[$editedIndex]], ]; } if ($suffix > $contextSuffix) { $rows[] = [ 'type' => 'separator', 'before' => null, 'after' => null, 'label' => sprintf('%d unchanged lines', $suffix - $contextSuffix), ]; } return $rows; } private static function alignChangedLines(array $originalLines, array $editedLines, $originalStart, $editedStart) { $originalCount = count($originalLines); $editedCount = count($editedLines); if ($originalCount * $editedCount > self::MAXIMUM_DIFF_MATRIX_CELLS) { $rows = []; static::appendChangedBlock($rows, $originalLines, $editedLines, $originalStart, $editedStart); return $rows; } $matrix = array_fill(0, $originalCount + 1, array_fill(0, $editedCount + 1, 0)); for ($originalIndex = $originalCount - 1; $originalIndex >= 0; $originalIndex--) { for ($editedIndex = $editedCount - 1; $editedIndex >= 0; $editedIndex--) { $matrix[$originalIndex][$editedIndex] = $originalLines[$originalIndex] === $editedLines[$editedIndex] ? $matrix[$originalIndex + 1][$editedIndex + 1] + 1 : max($matrix[$originalIndex + 1][$editedIndex], $matrix[$originalIndex][$editedIndex + 1]); } } $rows = []; $removed = []; $added = []; $originalIndex = 0; $editedIndex = 0; while ($originalIndex < $originalCount || $editedIndex < $editedCount) { if ($originalIndex < $originalCount && $editedIndex < $editedCount && $originalLines[$originalIndex] === $editedLines[$editedIndex]) { static::appendChangedBlock( $rows, $removed, $added, $originalStart + $originalIndex - count($removed), $editedStart + $editedIndex - count($added) ); $removed = []; $added = []; $rows[] = [ 'type' => 'context', 'before' => ['number' => $originalStart + $originalIndex, 'content' => $originalLines[$originalIndex]], 'after' => ['number' => $editedStart + $editedIndex, 'content' => $editedLines[$editedIndex]], ]; $originalIndex++; $editedIndex++; } elseif ($editedIndex >= $editedCount || ($originalIndex < $originalCount && $matrix[$originalIndex + 1][$editedIndex] >= $matrix[$originalIndex][$editedIndex + 1])) { $removed[] = $originalLines[$originalIndex]; $originalIndex++; } else { $added[] = $editedLines[$editedIndex]; $editedIndex++; } } static::appendChangedBlock( $rows, $removed, $added, $originalStart + $originalIndex - count($removed), $editedStart + $editedIndex - count($added) ); return $rows; } private static function appendChangedBlock(array &$rows, array $removed, array $added, $originalStart, $editedStart) { $count = max(count($removed), count($added)); for ($index = 0; $index < $count; $index++) { $before = isset($removed[$index]) ? ['number' => $originalStart + $index, 'content' => $removed[$index]] : null; $after = isset($added[$index]) ? ['number' => $editedStart + $index, 'content' => $added[$index]] : null; $rows[] = [ 'type' => $before === null ? 'added' : ($after === null ? 'removed' : 'modified'), 'before' => $before, 'after' => $after, ]; } } /** * Validate proposed PHP contents without executing them. * * @return array */ public static function validatePhpContents($file, $contents) { if (!static::isPhpFile($file)) { return ['checked' => false, 'valid' => true, 'message' => 'Syntax check not required for this file type.']; } if (!is_string($contents)) { throw new \InvalidArgumentException('PHP syntax validation requires string contents.'); } $temporary = tempnam(sys_get_temp_dir(), 'amwscan-lint-'); if ($temporary === false || file_put_contents($temporary, $contents, LOCK_EX) === false) { if (is_string($temporary) && is_file($temporary)) { @unlink($temporary); } throw new \RuntimeException('Unable to create the temporary PHP syntax-check file.'); } try { return static::runPhpLint($temporary, $file); } finally { @unlink($temporary); } } protected static function runPhpLint($lintFile, $displayFile) { $standardOutputFile = tempnam(sys_get_temp_dir(), 'amwscan-lint-output-'); $errorOutputFile = tempnam(sys_get_temp_dir(), 'amwscan-lint-error-'); if ($standardOutputFile === false || $errorOutputFile === false) { if (is_string($standardOutputFile)) { @unlink($standardOutputFile); } if (is_string($errorOutputFile)) { @unlink($errorOutputFile); } throw new \RuntimeException('Unable to create PHP syntax-check output files.'); } $descriptors = [ ['pipe', 'r'], ['file', $standardOutputFile, 'w'], ['file', $errorOutputFile, 'w'], ]; try { $process = proc_open([static::phpLintBinary(), '-l', $lintFile], $descriptors, $pipes, null, null, ['bypass_shell' => true]); if (!is_resource($process)) { throw new \RuntimeException('Unable to start the PHP syntax checker.'); } fclose($pipes[0]); $exitCode = proc_close($process); $errorOutput = trim(static::readLintOutput($errorOutputFile)); $standardOutput = trim(static::readLintOutput($standardOutputFile)); $message = $errorOutput !== '' ? $errorOutput : $standardOutput; $message = preg_replace('/\s*Errors parsing\s+' . preg_quote($lintFile, '/') . '\s*$/i', '', $message); $message = str_replace($lintFile, preg_replace('/[\x00-\x1F\x7F]/', '?', (string)$displayFile), $message); return [ 'checked' => true, 'valid' => $exitCode === 0, 'message' => $message, ]; } finally { @unlink($standardOutputFile); @unlink($errorOutputFile); } } protected static function phpLintBinary() { return static::resolvePhpLintBinary( PHP_BINARY, PHP_SAPI, defined('PHP_BINDIR') ? PHP_BINDIR : dirname(PHP_BINARY), getenv('PATH') ?: '' ); } protected static function resolvePhpLintBinary($phpBinary, $sapi, $phpBindir, $path) { $binaryName = DIRECTORY_SEPARATOR === '\\' ? 'php.exe' : 'php'; $candidates = []; if ($sapi === 'cli') { $candidates[] = $phpBinary; } $candidates[] = dirname($phpBinary) . DIRECTORY_SEPARATOR . $binaryName; $candidates[] = rtrim($phpBindir, '/\\') . DIRECTORY_SEPARATOR . $binaryName; foreach (array_filter(explode(PATH_SEPARATOR, (string)$path)) as $directory) { $candidates[] = rtrim($directory, '/\\') . DIRECTORY_SEPARATOR . $binaryName; } foreach (array_unique($candidates) as $candidate) { if (is_file($candidate) && is_executable($candidate)) { return $candidate; } } throw new \RuntimeException('The PHP CLI binary required for syntax validation is unavailable.'); } private static function readLintOutput($file) { $handle = @fopen($file, 'rb'); if ($handle === false) { return ''; } try { $output = fread($handle, self::MAXIMUM_LINT_OUTPUT_BYTES); return $output === false ? '' : $output; } finally { fclose($handle); } } private static function isPhpFile($file) { return in_array(strtolower(pathinfo((string)$file, PATHINFO_EXTENSION)), [ 'php', 'php3', 'ph3', 'php4', 'ph4', 'php5', 'ph5', 'php7', 'ph7', 'php8', 'ph8', 'phtm', 'phtml', ], true); } /** * Clean Quarantine path. * * @return bool */ public static function cleanQuarantine() { return self::unlink(Scanner::getPathQuarantine()); } /** * Unlink. * * @return bool */ protected static function unlink($path) { if (is_dir($path) && !is_link($path)) { return self::withTemporaryPermissions($path, 0700, static function () use ($path) { $entries = @scandir($path); if ($entries === false) { return false; } foreach ($entries as $entry) { if ($entry === '.' || $entry === '..') { continue; } if (!self::unlink($path . DIRECTORY_SEPARATOR . $entry)) { return false; } } return self::withWritableParent($path, static function () use ($path) { return rmdir($path); }); }); } if (file_exists($path) || is_link($path)) { return self::withWritableParent($path, static function () use ($path) { return unlink($path); }); } return false; } protected static function withWritableParent($path, callable $action) { $parent = dirname($path); if ($parent === '' || $parent === '.' || $parent === DIRECTORY_SEPARATOR) { return $action(); } return self::withTemporaryPermissions($parent, 0300, $action); } protected static function withTemporaryPermissions($path, $required, callable $action) { $permissions = @fileperms($path); $original = $permissions === false ? null : $permissions & 07777; $changed = $original !== null && ($original & $required) !== $required && @chmod($path, $original | $required); if ($changed) { clearstatcache(true, $path); } try { return $action(); } finally { if ($changed && file_exists($path)) { @chmod($path, $original); clearstatcache(true, $path); } } } } flf2a$ 7 5 20 -1 2 rozzo.flf font by Mike Rosulek [unar2@sfa.ope.ed.gov] 1/12/95 This was based on FujiyamaBlack TrueType Font. $$# $$# $$# $$# $$# $$# $$## 888$# 888$# "8"$# e $# "8"$# $# $## 8 8$# 8 8$# $# $# $# $# $## d8P d8"$# 88888888888$# d8P d8P $# 88888888888$# e8P d8P $# $# $## 8 $# d8 8e $# C88 $# Y8 8b $# 88D$# "8 8P $# 8 $## ,8, / $# "8"/ $# / $# /,8, $# / "8" $# $# $## d8b,$# ,db YP'$# e Y8b ,$# d8b Y8b" $# Y88b Y8b $# $# $## d8b$# Y8P$# ,P $# P $# $# $# $## e88$# d888$# e8888$# 88888$# "8888$# Y888$# "88$## 88e $# 888b $# 8888e$# 88888$# 8888"$# 888P $# 88" $## Yb 8 dP$# `D8K' $# dP 8 Yb$# $# $# $# $## $# 8 $# 88888$# 8 $# $# $# $## $# $# $# d8b$# Y8P$# ,P $# P $## $# $# 888$# $# $# $# $## $# $# $# d8b$# Y8P$# $# $## d8P$# d8P $# d8P $# d8P $# d8P $# $# $## e88 88e $# d888 888b $# C8888 8888D$# Y888 888P $# "88 88" $# $# $## d88$# d888$# d"888$# 888$# 888$# $# $## ,8,"88e $# " 888D$# 88P $# ,*" $# 8888888$# $# $## ,8,"88b,$# " ,88P'$# C8K $# e `88b,$# "8",88P'$# $# $## d 888 $# d8 888 $# d88 888e$# """ 888"$# 888 $# $# $## 8888888$# 88 $# """Y88b$# e 888$# "8",88P$# $# $## e88",8, $# d888 " $# C8888 88e $# Y888 888D$# "88 88" $# $# $## 888888$# ,e$# ,eP $# ,e8P $# 88P $# $# $## ,d8 8b, $# "Y8 8P" $# ,d8 8b, $# C888 888D$# "Y8 8P" $# $# $## e88 88e $# C888 888b $# "88 8888D$# e 888P $# "8",88" $# $# $## d8b$# Y8P$# $# d8b$# Y8P$# $# $## d8b$# Y8P$# $# d8b$# Y8P$# ,P $# P $## d8P$# d8P $# C8K $# Y8b $# Y8b$# $# $## $# 8888888$# $# 8888888$# $# $# $## Y8b $# Y8b $# D8D$# d8P $# d8P $# $# $## ,8,'88b $# " 888D$# 88P $# ,"' $# "8" $# $# $## ,e""""e, $# e" e"""e"e$# 8 C 8 8$# "e "*ee"*"$# `"eeeee" $# $# $## e Y8b $# d8b Y8b $# d888b Y8b $# d888888888b $# d8888888b Y8b$# $# $## 888 88b,$# 888 88P'$# 888 8K $# 888 88b,$# 888 88P'$# $# $## e88'Y88$# d888 'Y$# C8888 $# Y888 ,d$# "88,d88$# $# $## 888 88e $# 888 888b $# 888 8888D$# 888 888P $# 888 88" $# $# $## 888'Y88$# 888 ,'Y$# 888C8 $# 888 ",d$# 888,d88$# $# $## 888'Y88$# 888 ,'Y$# 888C8 $# 888 " $# 888 $# $# $## e88'Y88 $# d888 'Y $# C8888 eeee$# Y888 888P$# "88 88" $# $# $## 888 888$# 888 888$# 8888888$# 888 888$# 888 888$# $# $## 888$# 888$# 888$# 888$# 888$# $# $## 888$# 888$# 888$# e 88P$# "8",P' $# $# $## 888 88P$# 888 8P $# 888 K $# 888 8b $# 888 88b$# $# $## 888 $# 888 $# 888 $# 888 ,d$# 888,d88$# $# $## e e $# d8b d8b $# e Y8b Y8b $# d8b Y8b Y8b $# d888b Y8b Y8b$# $# $## Y88b Y88$# Y88b Y8$# b Y88b Y$# 8b Y88b $# 88b Y88b$# $# $## e88 88e $# d888 888b $# C8888 8888D$# Y888 888P $# "88 88" $# $# $## 888 88e $# 888 888D$# 888 88" $# 888 $# 888 $# $# $## e88 88e $# d888 888b $# C8888 8888D$# Y888 888P $# "88 88" $# b $# 8b, $## 888 88e $# 888 888D$# 888 88" $# 888 b, $# 888 88b,$# $# $## dP"8$# C8b Y$# Y8b $# b Y8D$# 8edP $# $# $## 88P'888'Y88$# P' 888 'Y$# 888 $# 888 $# 888 $# $# $## 8888 8888$# 8888 8888$# 8888 8888$# 8888 8888$# 'Y88 88P'$# $# $## Y8b Y88888P$# Y8b Y888P $# Y8b Y8P $# Y8b Y $# Y8P $# $# $## Y8b Y8b Y888P$# Y8b Y8b Y8P $# Y8b Y8b Y $# Y8b Y8b $# Y8P Y $# $# $## Y8b Y8P$# Y8b Y $# Y8b $# e Y8b $# d8b Y8b$# $# $## Y88b Y8P$# Y88b Y $# Y88b $# 888 $# 888 $# $# $## 8P d8P$# P d8P $# d8P d$# d8P d8$# d8P d88$# $# $## 8888$# 88 $# 88 $# 88 $# 88 $# 88 $# 8888$## d8P$# d8P $# d8P $# d8P $# d8P $# $# $## 8888$# 88$# 88$# 88$# 88$# 88$# 8888$## d8b $# dP Yb$# $# $# $# $# $## $# $# $# $# $# 888$# $## Y88$# Y8$# Y$# $# $# $# $## $# ,"Y88b$# "8" 888$# ,ee 888$# "88 888$# $# $## 888 $# 888 88e $# 888 888b$# 888 888P$# 888 88" $# $# $## $# e88'888$# d888 '8$# Y888 ,$# "88,e8'$# $# $## 888$# e88 888$# d888 888$# Y888 888$# "88 888$# $# $## $# ,e e, $# d88 88b$# 888 ,$# "YeeP"$# $# $## dP,e,$# 8b " $# 888888$# 888 $# 888 $# $# $## $# e88 888$# d888 888$# Y888 888$# "88 888$# , 88P$# "8",P" $## 888 $# 888 ee $# 888 88b$# 888 888$# 888 888$# $# $## ,e,$# " $# 888$# 888$# 888$# $# $## ,e,$# " $# 888$# 888$# 888$# 88P$# 8" $## 888 $# 888 ee$# 888 P $# 888 b $# 888 8b$# $# $## 888$# 888$# 888$# 888$# 888$# $# $## $# 888 888 8e $# 888 888 88b$# 888 888 888$# 888 888 888$# $# $## $# 888 8e $# 888 88b$# 888 888$# 888 888$# $# $## $# e88 88e $# d888 888b$# Y888 888P$# "88 88" $# $# $## $# 888 88e $# 888 888b$# 888 888P$# 888 88" $# 888 $# 888 $## $# e88 888$# d888 888$# Y888 888$# "88 888$# 888$# 888$## $# 888,8,$# 888 " $# 888 $# 888 $# $# $## $# dP"Y$# C88b $# Y88D$# d,dP $# $# $## d8 $# d88 $# d88888$# 888 $# 888 $# $# $## $# 8888 8888$# 8888 8888$# Y888 888P$# "88 88" $# $# $## $# Y8b Y888P$# Y8b Y8P $# Y8b " $# Y8P $# $# $## $# Y8b Y8b Y888P$# Y8b Y8b Y8P $# Y8b Y8b " $# YP Y8P $# $# $## $# Y8b Y8Y$# Y8b Y $# e Y8b $# d8b Y8b $# $# $## $# Y8b Y888P$# Y8b Y8P $# Y8b Y $# 888 $# 888 $# 888 $## $# 8P d8P$# P d8P $# d8P d$# d8P d8$# $# $## ,888$# 88 $# e8P $# C8K $# "8b $# 88 $# "888$## 88$# 88$# 88$# 88$# 88$# 88$# 88$## 888, $# 88 $# Y8 $# D8D$# d8 $# 88 $# 888" $## ,d8b,d8$# 8P"Y8P"$# $# $# $# $# $## e e Y8b e $# "8"d8b Y8b"8"$# d888b Y8b $# d888888888b $# d8888888b Y8b$# $# $## e e88 88e e $# "8"d888 888b"8"$# C8888 8888D $# Y888 888P $# "88 88" $# $# $## e 8888 8888 e $# "8" 8888 8888 "8"$# 8888 8888 $# Y888 888P $# "88 88" $# $# $## e e $# "8","Y88b"8"$# "8" 888 $# ,ee 888 $# "88 888 $# $# $## $# e e88 88e e $# "8"d888 888b"8"$# Y888 888P $# "88 88" $# $# $## e e $# "8"8888 8888"8"$# 8888 8888 $# Y888 888P $# "88 88" $# $# $## $# dP"Y$# C88b $# Y88D$# d,dP $# $# $## flf2a$ 11 8 20 32 13 Colossal.flf (Jonathon - jon@mq.edu.au) 8 June 1994 Explanation of first line: flf2 - "magic number" for file identification a - should always be `a', for now $ - the "hardblank" -- prints as a blank, but can't be smushed 11 - height of a character 8 - height of a character, not including descenders 20 - max line length (excluding comment lines) + a fudge factor 32 - default smushmode for this font 13 - number of comment lines $ $@ $ $@ $ $@ $ $@ $ $@ $ $@ $ $@ $ $@ $ $@ $ $@ $ $@@ 888$@ 888$@ 888$@ 888$@ 888$@ Y8P$@ " $@ 888$@ @ @ @@ 88 88$@ 8P 8P$@ " " $@ $ $ @ $ $ @ $ $ @ $ $ @ $ $ @ $ $ @ $ $ @ $ $ @@ 888 888 $@ 888 888 $@ 888888888888$@ 888 888 $@ 888 888 $@ 888888888888$@ 888 888 $@ 888 888 $@ $@ $@ $@@ 88 $@ .d88888b. $@ d88P 88"88b$@ Y88b.88 $ @ "Y88888b.$ @ 88"88b$@ Y88b 88.88P$@ "Y88888P"$ @ 88 @ @ @@ d88b d88P$@ Y88P d88P $@ d88P $ @ d88P $ @ $ d88P $ @ $ d88P $ @ $d88P d88b$@ d88P Y88P$@ @ @ @@ .d8888b. $ @ d88P "88b $ @ Y88b. d88P $ @ "Y8888P" $ @ .d88P88K.d88P$@ 888" Y888P" $@ Y88b .d8888b $@ "Y8888P" Y88b@ @ @ @@ d8b$@ 88P$@ 8P $@ " $ @ $ @ $ @ $ @ $ @ $ @ $ @ $ @@ $.d88$@ $d88P"$@ d88P $ @ 888 $ @ 888 $ @ Y88b $ @ $Y88b.$@ $"Y88$@ @ @ @@ 88b.$ @ "Y88b$ @ Y88b$@ 888$@ 888$@ d88P$@ .d88P$ @ 88P"$ @ @ @ @@ @ o $ @ d8b $ @ d888b $ @ "Y888888888P"@ "Y88888P"$ @ d88P"Y88b $@ dP" "Yb$@ @ @ @@ $ @ $ @ $ @ 888 $@ 8888888$@ 888 $@ $ @ $ @ $ @ $ @ $ @@ $ @ $ @ $ @ $ @ $ @ $ @ d8b$@ 88P$@ 8P @ " @ @@ $ $ @ $ $ @ $ $ @ $ $ @ $ $ @ 888888$@ $ $ @ $ $ @ $ $ @ $ $ @ $ $ @@ $ @ $ @ $ @ $ @ $ @ $ @ d8b$@ Y8P$@ @ @ @@ $ d88P$@ $ d88P $@ $ d88P $ @ $ d88P $ @ $ d88P $ @ $ d88P $ @ $d88P $ @ d88P $ @ @ @ @@ $.d8888b.$ @ d88P Y88b$@ 888 888$@ 888 888$@ 888 888$@ 888 888$@ Y88b d88P$@ $"Y8888P"$ @ @ @ @@ d888 $ @ d8888 $ @ 888 $ @ 888 $ @ 888 $ @ 888 $ @ 888 $ @ 8888888$@ @ @ @@ .d8888b.$ @ d88P Y88b$@ $ 888$@ $ .d88P$@ .od888P" $@ d88P" $@ 888" $@ 888888888 $@ @ @ @@ .d8888b.$ @ d88P Y88b$@ $ .d88P$@ $ 8888" $@ $ "Y8b.$@ 888 888$@ Y88b d88P$@ "Y8888P" $@ @ @ @@ d8888 $@ d8P888 $@ d8P 888 $@ d8P 888 $@ d88 888 $@ 8888888888$@ 888 $@ 888 $@ @ @ @@ 888888888$ @ 888 $ @ 888 $ @ 8888888b.$ @ $ "Y88b$@ $ 888$@ Y88b d88P$@ "Y8888P"$ @ @ @ @@ $.d8888b.$ @ d88P Y88b$@ 888 $ @ 888d888b.$ @ 888P "Y88b$@ 888 888$@ Y88b d88P$@ $"Y8888P"$ @ @ @ @@ 8888888888$@ $ d88P$@ $ d88P $@ $ d88P $ @ $88888888$ @ $ d88P $ @ $d88P $ @ d88P $ @ @ @ @@ .d8888b.$ @ d88P Y88b$@ Y88b. d88P$@ "Y88888" $@ .d8P""Y8b.$@ 888 888$@ Y88b d88P$@ "Y8888P" $@ @ @ @@ $.d8888b.$ @ d88P Y88b$@ 888 888$@ Y88b. d888$@ $"Y888P888$@ $ 888$@ Y88b d88P$@ "Y8888P"$ @ @ @ @@ $ @ $ @ $ @ d8b$@ Y8P$@ $ @ d8b$@ Y8P$@ @ @ @@ $ @ $ @ $ @ d8b @ Y8P @ $ @ d8b$@ 88P$@ 8P @ " @ @@ $ d88P$@ $ d88P $@ d88P $ @ d88P $ @ Y88b $ @ Y88b $ @ $ Y88b $@ $ Y88b$@ @ @ @@ $ $ @ $ $ @ $ $ @ 888888$@ $ $ @ 888888$@ $ $ @ $ $ @ $ $ @ $ $ @ $ $ @@ Y88b $ @ Y88b $ @ Y88b $@ Y88b$@ d88P$@ d88P $@ d88P $ @ d88P $ @ @ @ @@ $.d8888b.$ @ d88P Y88b$@ $ .d88P$@ $ .d88P"$ @ $ 888" $ @ $ 888 $ @ $ $ @ $ 888 $ @ @ @ @@ $.d8888888b.$ @ d88P" "Y88b$@ 888 d8b 888$@ 888 888 888$@ 888 888bd88P$@ 888 Y8888P" $@ Y88b. .d8$@ $"Y88888888P"$@ @ @ @@ $d8888$@ $d88888$@ $d88P888$@ $d88P 888$@ $d88P 888$@ $d88P 888$@ $d8888888888$@ d88P 888$@ @ @ @@ 888888b.$ @ 888 "88b$ @ 888 .88P$ @ 8888888K.$ @ 888 "Y88b$@ 888 888$@ 888 d88P$@ 8888888P"$ @ @ @ @@ $.d8888b.$ @ d88P Y88b$@ 888 888$@ 888 $ @ 888 $ @ 888 888$@ Y88b d88P$@ $"Y8888P"$ @ @ @ @@ 8888888b.$ @ 888 "Y88b$@ 888 888$@ 888 888$@ 888 888$@ 888 888$@ 888 .d88P$@ 8888888P"$ @ @ @ @@ 8888888888$@ 888 $ @ 888 $ @ 8888888$ @ 888 $ @ 888 $ @ 888 $ @ 8888888888$@ @ @ @@ 8888888888$@ 888 $ @ 888 $ @ 8888888$ @ 888 $ @ 888 $ @ 888 $ @ 888 $ @ @ @ @@ $.d8888b.$ @ d88P Y88b$@ 888 888$@ 888 $@ 888 88888$@ 888 888$@ Y88b d88P$@ $"Y8888P88$@ @ @ @@ 888 888$@ 888 888$@ 888 888$@ 8888888888$@ 888 888$@ 888 888$@ 888 888$@ 888 888$@ @ @ @@ 8888888$@ 888 $ @ 888 $ @ 888 $ @ 888 $ @ 888 $ @ 888 $ @ 8888888$@ @ @ @@ 888888$@ "88b$@ 888$@ 888$@ 888$@ 888$@ 88P$@ 888$@ .d88P$@ .d88P"$ @ 888P" $ @@ 888 d8P$ @ 888 d8P $ @ 888 d8P $ @ 888d88K $ @ 8888888b $ @ 888 Y88b $ @ 888 Y88b $@ 888 Y88b$@ @ @ @@ 888 $ @ 888 $ @ 888 $ @ 888 $ @ 888 $ @ 888 $ @ 888 $ @ 88888888$@ @ @ @@ 888b d888$@ 8888b d8888$@ 88888b.d88888$@ 888Y88888P888$@ 888 Y888P 888$@ 888 Y8P 888$@ 888 " 888$@ 888 888$@ @ @ @@ 888b 888$@ 8888b 888$@ 88888b 888$@ 888Y88b 888$@ 888 Y88b888$@ 888 Y88888$@ 888 Y8888$@ 888 Y888$@ @ @ @@ $.d88888b.$ @ d88P" "Y88b$@ 888 888$@ 888 888$@ 888 888$@ 888 888$@ Y88b. .d88P$@ $"Y88888P"$ @ @ @ @@ 8888888b.$ @ 888 Y88b$@ 888 888$@ 888 d88P$@ 8888888P"$ @ 888 $ @ 888 $ @ 888 $ @ @ @ @@ $.d88888b.$ @ d88P" "Y88b$@ 888 888$@ 888 888$@ 888 888$@ 888 Y8b 888$@ Y88b.Y8b88P$@ $"Y888888" $@ Y8b $@ @ @@ 8888888b.$ @ 888 Y88b$@ 888 888$@ 888 d88P$@ 8888888P"$ @ 888 T88b $ @ 888 T88b$ @ 888 T88b$@ @ @ @@ $.d8888b.$ @ d88P Y88b$@ Y88b. $ @ $"Y888b. $ @ $ "Y88b.$@ $ "888$@ Y88b d88P$@ "Y8888P"$ @ @ @ @@ 88888888888$@ 888 $ @ 888 $ @ 888 $ @ 888 $ @ 888 $ @ 888 $ @ 888 $ @ @ @ @@ 888 888$@ 888 888$@ 888 888$@ 888 888$@ 888 888$@ 888 888$@ Y88b. .d88P$@ $"Y88888P"$ @ @ @ @@ 888 888$@ 888 888$@ 888 888$@ Y88b d88P$@ Y88b d88P $@ Y88o88P $ @ Y888P $ @ Y8P $ @ @ @ @@ 888 888$@ 888 o 888$@ 888 d8b 888$@ 888 d888b 888$@ 888d88888b888$@ 88888P Y88888$@ 8888P Y8888$@ 888P Y888$@ @ @ @@ Y88b d88P$@ Y88b d88P $@ Y88o88P $ @ Y888P $ @ d888b $ @ d88888b $ @ d88P Y88b $@ d88P Y88b$@ @ @ @@ Y88b d88P$@ Y88b d88P $@ Y88o88P $ @ Y888P $ @ 888 $ @ 888 $ @ 888 $ @ 888 $ @ @ @ @@ 8888888888P$@ $ d88P $@ $ d88P $ @ $ d88P $ @ $ d88P $ @ $ d88P $ @ $d88P $ @ d8888888888$@ @ @ @@ 8888888$@ 888 $ @ 888 $ @ 888 $ @ 888 $ @ 888 $ @ 888 $ @ 8888888$@ @ @ @@ Y88b $ @ $Y88b $ @ $ Y88b $ @ $ Y88b $ @ $ Y88b $ @ $ Y88b $ @ $ Y88b $@ $ Y88b$@ @ @ @@ 8888888$@ $ 888$@ $ 888$@ $ 888$@ $ 888$@ $ 888$@ $ 888$@ 8888888$@ @ @ @@ o$ @ d8b$ @ d888b$ @ d8P"Y8b$@ $ $ @ $ $ @ $ $ @ $ $ @ $ $ @ $ $ @ $ $ @@ $ $ @ $ $ @ $ $ @ $ $ @ $ $ @ $ $ @ $ $ @ 88888888$@ @ @ @@ d8b$@ Y88$@ Y8$@ Y$@ $ @ $ @ $ @ $ @ $ @ $ @ $ @@ @ @ @ $8888b. $@ $ "88b$@ .d888888$@ 888 888$@ "Y888888$@ @ @ @@ 888 $ @ 888 $ @ 888 $ @ 88888b.$ @ 888 "88b$@ 888 888$@ 888 d88P$@ 88888P"$ @ @ @ @@ @ @ @ $.d8888b$@ d88P" $ @ 888 $ @ Y88b. $ @ $"Y8888P$@ @ @ @@ 888$@ 888$@ 888$@ $.d88888$@ d88" 888$@ 888 888$@ Y88b 888$@ $"Y88888$@ @ @ @@ @ @ @ $.d88b.$ @ d8P Y8b$@ 88888888$@ Y8b.$ @ $"Y8888$ @ @ @ @@ $.d888$@ d88P"$ @ 888 $ @ 888888$@ 888 $ @ 888 $ @ 888 $ @ 888 $ @ @ @ @@ @ @ @ $.d88b.$ @ d88P"88b$@ 888 888$@ Y88b 888$@ $"Y88888$@ $ 888$@ Y8b d88P$@ "Y88P"$ @@ 888 $ @ 888 $ @ 888 $ @ 88888b.$ @ 888 "88b$@ 888 888$@ 888 888$@ 888 888$@ @ @ @@ d8b$@ Y8P$@ $ $@ 888$@ 888$@ 888$@ 888$@ 888$@ @ @ @@ $d8b$@ $Y8P$@ $ $@ $8888$@ $"888$@ $ 888$@ $ 888$@ $ 888$@ $ 888$@ $ d88P$@ 888P"$ @@ 888 $ @ 888 $ @ 888 $ @ 888 888$@ 888 .88P$@ 888888K$ @ 888 "88b$@ 888 888$@ @ @ @@ 888$@ 888$@ 888$@ 888$@ 888$@ 888$@ 888$@ 888$@ @ @ @@ @ @ @ 88888b.d88b.$ @ 888 "888 "88b$@ 888 888 888$@ 888 888 888$@ 888 888 888$@ @ @ @@ @ @ @ 88888b.$ @ 888 "88b$@ 888 888$@ 888 888$@ 888 888$@ @ @ @@ @ @ @ $.d88b.$ @ d88""88b$@ 888 888$@ Y88..88P$@ $"Y88P"$ @ @ @ @@ @ @ @ 88888b.$ @ 888 "88b$@ 888 888$@ 888 d88P$@ 88888P"$ @ 888 $ @ 888 $ @ 888 $ @@ @ @ @ $.d88888$@ d88" 888$@ 888 888$@ Y88b 888$@ $"Y88888$@ $ 888$@ $ 888$@ $ 888$@@ @ @ @ 888d888$@ 888P"$ @ 888 $ @ 888 $ @ 888 $ @ @ @ @@ @ @ @ .d8888b$ @ 88K $ @ "Y8888b.$@ $ X88$@ $88888P'$@ @ @ @@ 888 $ @ 888 $ @ 888 $ @ 888888$@ 888 $ @ 888 $ @ Y88b.$ @ "Y888$@ @ @ @@ @ @ @ 888 888$@ 888 888$@ 888 888$@ Y88b 888$@ $"Y88888$@ @ @ @@ @ @ @ 888 888$@ 888 888$@ Y88 88P$@ $Y8bd8P$ @ $ Y88P $ @ @ @ @@ @ @ @ 888 888 888$@ 888 888 888$@ 888 888 888$@ Y88b 888 d88P$@ $"Y8888888P"$ @ @ @ @@ @ @ @ 888 888$@ `Y8bd8P'$@ $ X88K $ @ .d8""8b.$@ 888 888$@ @ @ @@ @ @ @ 888 888$@ 888 888$@ 888 888$@ Y88b 888$@ $"Y88888$@ $ 888$@ Y8b d88P$@ $"Y88P"$ @@ @ @ @ 88888888$@ $ d88P $@ $ d88P $ @ $d88P $ @ 88888888$@ @ @ @@ $.d888$@ $d88P"$ @ $888 $ @ .888 $ @ 888( $ @ "888 $ @ $888 $ @ $Y88b.$ @ $"Y888$@ @ @@ $ 888 $@ $ 888 $@ $ 888 $@ $ 888 $@ $ $@ $ 888 $@ $ 888 $@ $ 888 $@ $ 888 $@ @ @@ 888b. $ @ $"Y88b $@ $ 888 $@ $ 888.$@ $ )888$@ $ 888"$@ $ 888 $@ $.d88P $@ 888P" $ @ @ @@ @ @ $d888b d88$@ d888888888P$@ 88P Y888P$ @ @ @ @ @ @ @@ d8b d8b@ Y8P Y8P@ $d88888$@ $d88P888$@ $d88P 888$@ $d88P 888$@ $d888888888$@ $d88P 888$@ @ @ @@ d8b d8b @ Y8P Y8P @ $.d88888b.$ @ d88P" "Y88b$@ 888 888$@ 888 888$@ Y88b. .d88P$@ $"Y88888P"$ @ @ @ @@ d8b d8b @ Y8P Y8P @ 888 888$@ 888 888$@ 888 888$@ 888 888$@ Y88b. .d88P$@ $"Y88888P"$ @ @ @ @@ d8b d8b @ Y8P Y8P @ @ $8888b. $@ $ "88b$@ .d888888$@ 888 888$@ "Y888888$@ @ @ @@ d8b d8b @ Y8P Y8P @ @ $.d88b.$ @ d88""88b$@ 888 888$@ Y88..88P$@ $"Y88P"$ @ @ @ @@ d8b d8b @ Y8P Y8P @ @ 888 888$@ 888 888$@ 888 888$@ Y88b 888$@ $"Y88888$@ @ @ @@ .d888b.$ @ d88" "88b$ @ 888 .88P$ @ 888 888K.$ @ 888 "Y88b$@ 888 888$@ 888 d88P$@ 888 888P"$ @ 888 @ 888 @ @@ flf2a$ 4 4 16 1 3 Adapted for figlet by Kent Nassen, kentn@cyberspace.org, 11/22/94, based on the idea: _________ @ || ||@ ||_______||@ |/_______\|@@ ____ @ ||! ||@ ||__||@ |/__\|@@ ____ @ ||" ||@ ||__||@ |/__\|@@ ____ @ ||# ||@ ||__||@ |/__\|@@ ____ @ ||$ ||@ ||__||@ |/__\|@@ ____ @ ||% ||@ ||__||@ |/__\|@@ ____ @ ||& ||@ ||__||@ |/__\|@@ ____ @ ||' ||@ ||__||@ |/__\|@@ ____ @ ||( ||@ ||__||@ |/__\|@@ ____ @ ||) ||@ ||__||@ |/__\|@@ ____ @ ||* ||@ ||__||@ |/__\|@@ ____ @ ||+ ||@ ||__||@ |/__\|@@ ____ @ ||, ||@ ||__||@ |/__\|@@ ____ @ ||- ||@ ||__||@ |/__\|@@ ____ @ ||. ||@ ||__||@ |/__\|@@ ____ @ ||/ ||@ ||__||@ |/__\|@@ ____ @ ||0 ||@ ||__||@ |/__\|@@ ____ @ ||1 ||@ ||__||@ |/__\|@@ ____ @ ||2 ||@ ||__||@ |/__\|@@ ____ @ ||3 ||@ ||__||@ |/__\|@@ ____ @ ||4 ||@ ||__||@ |/__\|@@ ____ @ ||5 ||@ ||__||@ |/__\|@@ ____ @ ||6 ||@ ||__||@ |/__\|@@ ____ @ ||7 ||@ ||__||@ |/__\|@@ ____ @ ||8 ||@ ||__||@ |/__\|@@ ____ @ ||9 ||@ ||__||@ |/__\|@@ ____ @ ||: ||@ ||__||@ |/__\|@@ ____ @ ||; ||@ ||__||@ |/__\|@@ ____ @ ||< ||@ ||__||@ |/__\|@@ ____ @ ||= ||@ ||__||@ |/__\|@@ ____ @ ||> ||@ ||__||@ |/__\|@@ ____ @ ||? ||@ ||__||@ |/__\|@@ ____ @ ||@ ||@ ||__||@ |/__\|@@ ____ @ ||A ||@ ||__||@ |/__\|@@ ____ @ ||B ||@ ||__||@ |/__\|@@ ____ @ ||C ||@ ||__||@ |/__\|@@ ____ @ ||D ||@ ||__||@ |/__\|@@ ____ @ ||E ||@ ||__||@ |/__\|@@ ____ @ ||F ||@ ||__||@ |/__\|@@ ____ @ ||G ||@ ||__||@ |/__\|@@ ____ @ ||H ||@ ||__||@ |/__\|@@ ____ @ ||I ||@ ||__||@ |/__\|@@ ____ @ ||J ||@ ||__||@ |/__\|@@ ____ @ ||K ||@ ||__||@ |/__\|@@ ____ @ ||L ||@ ||__||@ |/__\|@@ ____ @ ||M ||@ ||__||@ |/__\|@@ ____ @ ||N ||@ ||__||@ |/__\|@@ ____ @ ||O ||@ ||__||@ |/__\|@@ ____ @ ||P ||@ ||__||@ |/__\|@@ ____ @ ||Q ||@ ||__||@ |/__\|@@ ____ @ ||R ||@ ||__||@ |/__\|@@ ____ @ ||S ||@ ||__||@ |/__\|@@ ____ @ ||T ||@ ||__||@ |/__\|@@ ____ @ ||U ||@ ||__||@ |/__\|@@ ____ @ ||V ||@ ||__||@ |/__\|@@ ____ @ ||W ||@ ||__||@ |/__\|@@ ____ @ ||X ||@ ||__||@ |/__\|@@ ____ @ ||Y ||@ ||__||@ |/__\|@@ ____ @ ||Z ||@ ||__||@ |/__\|@@ ____ @ ||[ ||@ ||__||@ |/__\|@@ ____ @ ||\ ||@ ||__||@ |/__\|@@ ____ @ ||] ||@ ||__||@ |/__\|@@ ____ @ ||^ ||@ ||__||@ |/__\|@@ ____ @ ||_ ||@ ||__||@ |/__\|@@ ____ @ ||` ||@ ||__||@ |/__\|@@ ____ @ ||a ||@ ||__||@ |/__\|@@ ____ @ ||b ||@ ||__||@ |/__\|@@ ____ @ ||c ||@ ||__||@ |/__\|@@ ____ @ ||d ||@ ||__||@ |/__\|@@ ____ @ ||e ||@ ||__||@ |/__\|@@ ____ @ ||f ||@ ||__||@ |/__\|@@ ____ @ ||g ||@ ||__||@ |/__\|@@ ____ @ ||h ||@ ||__||@ |/__\|@@ ____ @ ||i ||@ ||__||@ |/__\|@@ ____ @ ||j ||@ ||__||@ |/__\|@@ ____ @ ||k ||@ ||__||@ |/__\|@@ ____ @ ||l ||@ ||__||@ |/__\|@@ ____ @ ||m ||@ ||__||@ |/__\|@@ ____ @ ||n ||@ ||__||@ |/__\|@@ ____ @ ||o ||@ ||__||@ |/__\|@@ ____ @ ||p ||@ ||__||@ |/__\|@@ ____ @ ||q ||@ ||__||@ |/__\|@@ ____ @ ||r ||@ ||__||@ |/__\|@@ ____ @ ||s ||@ ||__||@ |/__\|@@ ____ @ ||t ||@ ||__||@ |/__\|@@ ____ @ ||u ||@ ||__||@ |/__\|@@ ____ @ ||v ||@ ||__||@ |/__\|@@ ____ @ ||w ||@ ||__||@ |/__\|@@ ____ @ ||x ||@ ||__||@ |/__\|@@ ____ @ ||y ||@ ||__||@ |/__\|@@ ____ @ ||z ||@ ||__||@ |/__\|@@ ____ @ ||{ ||@ ||__||@ |/__\|@@ ____ @ ||| ||@ ||__||@ |/__\|@@ ____ @ ||} ||@ ||__||@ |/__\|@@ ____ @ ||~ ||@ ||__||@ |/__\|@@ @ @ @ @@ @ @ @ @@ @ @ @ @@ @ @ @ @@ @ @ @ @@ @ @ @ @@ @ @ @ @@ flf2a$ 8 8 17 -1 2 basic.flf by Craig O'Flaherty August 17, 1994 $$@ $$@ $$@ $$@ $$@ $$@ $$@ $$@@ db$@ 88$@ YP$@ $@ db$@ YP$@ $@ $@@ .o. .o.$@ `8' `8'$@ $@ $@ $@ $@ $@ $@@ $@ db db $@ C88888D$@ 88 88 $@ C88888D$@ YP YP $@ $@ $@@ A $@ .d8888.$@ 88'8 YP$@ `8b8. $@ `V8b.$@ db 8 8D$@ `8888Y'$@ V $@@ db dD$@ YP d8'$@ d8' $@ d8' $@ d8' db$@ d8' YP$@ $@ $@@ .d888b. $@ 8P 8D $@ `Vb d8' $@ d88C dD$@ C8' d8D $@ `888P Yb$@ $@ $@@ Cb$@ `D$@ '$@ $@ $@ $@ $@ $@@ dD$@ d8' $@ d8 $@ C88 $@ V8 $@ V8. $@ VD$@ $@@ Cb $@ `8b $@ 8b $@ 88D$@ 8P $@ .8P $@ CP $@ $@@ $@ 8. A .8$@ `8.8.8'$@ 888 $@ .d'8`b.$@ 8' V `8$@ $@ $@@ $@ db $@ 88 $@ C8888D$@ 88 $@ VP $@ $@ $@@ $@ $@ $@ $@ db$@ V8$@ P$@ $@@ $@ $@ $@ C8888D$@ $@ $@ $@ $@@ $@ $@ $@ $@ db$@ VP$@ $@ $@@ dD$@ d8'$@ d8' $@ d8' $@ d8' $@ C8' $@ $@ $@@ .d88b. $@ .8P 88.$@ 88 d'88$@ 88 d' 88$@ `88 d8'$@ `Y88P' $@ $@ $@@ db$@ o88$@ 88$@ 88$@ 88$@ VP$@ $@ $@@ .d888b.$@ VP `8D$@ odD'$@ .88' $@ j88. $@ 888888D$@ $@ $@@ d8888b.$@ VP `8D$@ oooY'$@ ~~~b.$@ db 8D$@ Y8888P'$@ $@ $@@ j88D $@ j8~88 $@ j8' 88 $@ V88888D$@ 88 $@ VP $@ $@ $@@ ooooo$@ 8P~~~~$@ dP $@ V8888b.$@ `8D$@ 88oobY'$@ $@ $@@ dD $@ d8' $@ d8' $@ d8888b.$@ 88' `8D$@ `8888P $@ $@ $@@ d88888D$@ VP d8'$@ d8' $@ d8' $@ d8' $@ d8' $@ $@ $@@ .d888b.$@ 88 8D$@ `VoooY'$@ .d~~~b.$@ 88 8D$@ `Y888P'$@ $@ $@@ .d888b.$@ 88' `8D$@ `V8o88'$@ d8' $@ d8' $@ d8' $@ $@ $@@ $@ db$@ VP$@ $@ db$@ VP$@ $@ $@@ $@ db$@ VP$@ $@ db$@ V8$@ P$@ $@@ $@ .dP$@ .d8 $@ ,P $@ `b $@ `Vb $@ `Vb$@ $@@ $@ C8888D$@ $@ C8888D$@ $@ $@ $@ $@@ $@ Vb $@ `Vb $@ `V.$@ .d'$@ .dP $@ dP $@ $@@ .d888b.$@ VP `8D$@ odD'$@ 8P' $@ oo $@ VP $@ $@ $@@ .o888b.$@ d8' Y8$@ 8P db dP$@ 8b V8o8P$@ Y8. d$@ `Y888P'$@ $@ $@@ .d8b. $@ d8' `8b$@ 88ooo88$@ 88~~~88$@ 88 88$@ YP YP$@ $@ $@@ d8888b.$@ 88 `8D$@ 88oooY'$@ 88~~~b.$@ 88 8D$@ Y8888P'$@ $@ $@@ .o88b.$@ d8P Y8$@ 8P $@ 8b $@ Y8b d8$@ `Y88P'$@ $@ $@@ d8888b.$@ 88 `8D$@ 88 88$@ 88 88$@ 88 .8D$@ Y8888D'$@ $@ $@@ d88888b$@ 88' $@ 88ooooo$@ 88~~~~~$@ 88. $@ Y88888P$@ $@ $@@ d88888b$@ 88' $@ 88ooo $@ 88~~~ $@ 88 $@ YP $@ $@ $@@ d888b $@ 88' Y8b$@ 88 $@ 88 ooo$@ 88. ~8~$@ Y888P $@ $@ $@@ db db$@ 88 88$@ 88ooo88$@ 88~~~88$@ 88 88$@ YP YP$@ $@ $@@ d888888b$@ `88' $@ 88 $@ 88 $@ .88. $@ Y888888P$@ $@ $@@ d88b$@ `8P'$@ 88 $@ 88 $@ db. 88 $@ Y8888P $@ $@ $@@ db dD$@ 88 ,8P'$@ 88,8P $@ 88`8b $@ 88 `88.$@ YP YD$@ $@ $@@ db $@ 88 $@ 88 $@ 88 $@ 88booo.$@ Y88888P$@ $@ $@@ .88b d88.$@ 88'YbdP`88$@ 88 88 88$@ 88 88 88$@ 88 88 88$@ YP YP YP$@ $@ $@@ d8b db$@ 888o 88$@ 88V8o 88$@ 88 V8o88$@ 88 V888$@ VP V8P$@ $@ $@@ .d88b. $@ .8P Y8.$@ 88 88$@ 88 88$@ `8b d8'$@ `Y88P' $@ $@ $@@ d8888b.$@ 88 `8D$@ 88oodD'$@ 88~~~ $@ 88 $@ 88 $@ $@ $@@ .d88b. $@ .8P Y8.$@ 88 88$@ 88 88$@ `8P d8'$@ `Y88'Y8$@ $@ $@@ d8888b.$@ 88 `8D$@ 88oobY'$@ 88`8b $@ 88 `88.$@ 88 YD$@ $@ $@@ .d8888.$@ 88' YP$@ `8bo. $@ `Y8b.$@ db 8D$@ `8888Y'$@ $@ $@@ d888888b$@ `~~88~~'$@ 88 $@ 88 $@ 88 $@ YP $@ $@ $@@ db db$@ 88 88$@ 88 88$@ 88 88$@ 88b d88$@ ~Y8888P'$@ $@ $@@ db db$@ 88 88$@ Y8 8P$@ `8b d8'$@ `8bd8' $@ YP $@ $@ $@@ db d8b db$@ 88 I8I 88$@ 88 I8I 88$@ Y8 I8I 88$@ `8b d8'8b d8'$@ `8b8' `8d8' $@ $@ $@@ db db$@ `8b d8'$@ `8bd8' $@ .dPYb. $@ .8P Y8.$@ YP YP$@ $@ $@@ db db$@ `8b d8'$@ `8bd8' $@ 88 $@ 88 $@ YP $@ $@ $@@ d88888D$@ YP d8'$@ d8' $@ d8' $@ d8' db$@ d88888P$@ $@ $@@ d88D$@ 88 $@ 88 $@ 88 $@ 88 $@ L88D$@ $@ $@@ Cb $@ `8b $@ `8b $@ `8b $@ `8b $@ `8D$@ $@ $@@ C88D$@ 88$@ 88$@ 88$@ 88$@ C888$@ $@ $@@ db $@ .dPVb. $@ dP' `Vb$@ $@ $@ $@ $@ $@@ $@ $@ $@ $@ $@ C88888D$@ $@ $@@ dD$@ C'$@ `$@ $@ $@ $@ $@ $@@ .d8b. $@ d8' `8b$@ 88ooo88$@ 88~~~88$@ 88 88$@ YP YP$@ $@ $@@ d8888b.$@ 88 `8D$@ 88oooY'$@ 88~~~b.$@ 88 8D$@ Y8888P'$@ $@ $@@ .o88b.$@ d8P Y8$@ 8P $@ 8b $@ Y8b d8$@ `Y88P'$@ $@ $@@ d8888b.$@ 88 `8D$@ 88 88$@ 88 88$@ 88 .8D$@ Y8888D'$@ $@ $@@ d88888b$@ 88' $@ 88ooooo$@ 88~~~~~$@ 88. $@ Y88888P$@ $@ $@@ d88888b$@ 88' $@ 88ooo $@ 88~~~ $@ 88 $@ YP $@ $@ $@@ d888b $@ 88' Y8b$@ 88 $@ 88 ooo$@ 88. ~8~$@ Y888P $@ $@ $@@ db db$@ 88 88$@ 88ooo88$@ 88~~~88$@ 88 88$@ YP YP$@ $@ $@@ d888888b$@ `88' $@ 88 $@ 88 $@ .88. $@ Y888888P$@ $@ $@@ d88b$@ `8P'$@ 88 $@ 88 $@ db. 88 $@ Y8888P $@ $@ $@@ db dD$@ 88 ,8P'$@ 88,8P $@ 88`8b $@ 88 `88.$@ YP YD$@ $@ $@@ db $@ 88 $@ 88 $@ 88 $@ 88booo.$@ Y88888P$@ $@ $@@ .88b d88.$@ 88'YbdP`88$@ 88 88 88$@ 88 88 88$@ 88 88 88$@ YP YP YP$@ $@ $@@ d8b db$@ 888o 88$@ 88V8o 88$@ 88 V8o88$@ 88 V888$@ VP V8P$@ $@ $@@ .d88b. $@ .8P Y8.$@ 88 88$@ 88 88$@ `8b d8'$@ `Y88P' $@ $@ $@@ d8888b.$@ 88 `8D$@ 88oodD'$@ 88~~~ $@ 88 $@ 88 $@ $@ $@@ .d88b. $@ .8P Y8.$@ 88 88$@ 88 88$@ `8P d8'$@ `Y88'Y8$@ $@ $@@ d8888b.$@ 88 `8D$@ 88oobY'$@ 88`8b $@ 88 `88.$@ 88 YD$@ $@ $@@ .d8888.$@ 88' YP$@ `8bo. $@ `Y8b.$@ db 8D$@ `8888Y'$@ $@ $@@ d888888b$@ `~~88~~'$@ 88 $@ 88 $@ 88 $@ YP $@ $@ $@@ db db$@ 88 88$@ 88 88$@ 88 88$@ 88b d88$@ ~Y8888P'$@ $@ $@@ db db$@ 88 88$@ Y8 8P$@ `8b d8'$@ `8bd8' $@ YP $@ $@ $@@ db d8b db$@ 88 I8I 88$@ 88 I8I 88$@ Y8 I8I 88$@ `8b d8'8b d8'$@ `8b8' `8d8' $@ $@ $@@ db db$@ `8b d8'$@ `8bd8' $@ .dPYb. $@ .8P Y8.$@ YP YP$@ $@ $@@ db db$@ `8b d8'$@ `8bd8' $@ 88 $@ 88 $@ YP $@ $@ $@@ d88888D$@ YP d8'$@ d8' $@ d8' $@ d8' db$@ d88888P$@ $@ $@@ .8P$@ 8' $@ .dP $@ C88 $@ `Yb $@ 8. $@ `8b$@ $@@ 8$@ 8$@ 8$@ $@ 8$@ 8$@ 8$@ $@@ V8. $@ `8 $@ Vb. $@ 88D$@ dP' $@ .8 $@ C8' $@ $@@ .oo. .$@ P' `VP'$@ $@ $@ $@ $@ $@ $@@ @ @ @ @ @ @ @ @@ @ @ @ @ @ @ @ @@ @ @ @ @ @ @ @ @@ @ @ @ @ @ @ @ @@ @ @ @ @ @ @ @ @@ @ @ @ @ @ @ @ @@ @ @ @ @ @ @ @ @@ flf2a$ 7 6 20 15 3 Stop by David Walton Derived from Rounded by Nick Miners N.M.Miners@durham.ac.uk 21 August 1994 $$# $$# $$# $$# $$# $$# $$## _ # | |# | |# |_|# _ # |_|# ## _ _ # ( )( )# |/ |/ # # # # ## __ _ # _| || |_ # (_ || _)# _| || |_ # (_ || _)# |__||_| # ## _ # _| |_ # | ___)# |___ |# (_ _|# |_| # ## _ _ # (_) | |# / / # / / # / / _ # |_| (_)# ## ___ # / _ \ # ( (_) ) # ) _ ( # ( (/ \ # \__/\_)# ## _ # ( )# |/ # # # # ## __ # / _)# / / # ( ( # \ \_ # \__)# ## __ # (_ \ # \ \ # ) )# _/ / # (__/ # ## _ _ _ # ( \| |/ )# \ _ / # (_ (_) _)# / \ # (_/|_|\_)# ## # _ # _| |_ # (_ _)# |_| # # ## # # # # _ # ( )# |/ ## # # ___ # (___)# # # ## # # # # _ # (_)# ## _ # | |# / / # / / # / / # |_| # ## ______ # / __ |# | | //| |# | |// | |# | /__| |# \_____/ # ## __ # / |# /_/ |# | |# | |# |_|# ## ______ # (_____ \ # ____) )# /_____/ # _______ # (_______)# ## ________# (_______/# ____ # (___ \ # _____) )# (______/ # ## __ # / / # / /____ # |___ _)# | | # |_| # ## _______ # (_______)# ______ # (_____ \ # _____) )# (______/ # ## __ # / / # / /_ # / __ \ # ( (__) )# \____/ # ## _______ # (_______)# _ # / ) # / / # (_/ # ## _____ # / ___ \ # ( ( ) )# > > < < # ( (___) )# \_____/ # ## ____ # / __ \ # ( (__) )# \__ / # / / # /_/ # ## # # _ # (_)# _ # (_)# ## # # _ # (_)# _ # ( )# |/ ## # _ _ # / )/ )# ( (( ( # \_)\_)# # ## # ___ # (___)# ___ # (___)# # ## # _ _ # ( \( \ # ) )) )# (_/(_/ # # ## ____ # (___ \ # ) )# /_/ # _ # (_) # ## $ $ # $ $ # $ $ # $ _|_$ # $__ | $ # $(_/|_/|_/$# $ $ ## # /\ # / \ # / /\ \ # | |__| |# |______|# ## ______ # (____ \ # ____) )# | __ ( # | |__) )# |______/ # ## ______ # / _____)# | / # | | # | \_____ # \______)# ## _____ # (____ \ # _ \ \ # | | | |# | |__/ / # |_____/ # ## _______ # (_______)# _____ # | ___) # | |_____ # |_______)# ## _______ # (_______)# _____ # | ___) # | | # |_| # ## ______ # / _____)# | / ___ # | | (___)# | \____/|# \_____/ # ## _ _ # | | | |# | |__ | |# | __)| |# | | | |# |_| |_|# ## _____ # (_____)# _ # | | # _| |_ # (_____)# ## _____ # (_____)# _ # | | # ___| | # (____/ # ## _ _ # | | / )# | | / / # | |< < # | | \ \ # |_| \_)# ## _ # | | # | | # | | # | |_____ # |_______)# ## ______ # | ___ \ # | | _ | |# | || || |# | || || |# |_||_||_|# ## ______ # | ___ \ # | | | |# | | | |# | | | |# |_| |_|# ## _____ # / ___ \ # | | | |# | | | |# | |___| |# \_____/ # ## ______ # (_____ \ # _____) )# | ____/ # | | # |_| # ## _____ # / ___ \ # | | | |# | | |_|# \ \____ # \_____)# ## ______ # (_____ \ # _____) )# (_____ ( # | |# |_|# ## _ # | | # \ \ # \ \ # _____) )# (______/ # ## _______ # (_______)# _ # | | # | |_____ # \______)# ## _ _ # | | | |# | | | |# | | | |# | |___| |# \______|# ## _ _ # | | | |# | | | |# \ \/ / # \ / # \/ # ## _ _ _ # | || || |# | || || |# | ||_|| |# | |___| |# \______|# ## _ _ # \ \ / /# \ \/ / # ) ( # / /\ \ # /_/ \_\# ## _ _ # | | | |# | |___| |# \_____/ # ___ # (___) # ## _______ # (_______)# __ # / / # / /____ # (_______)# ## ___ # | _)# | | # | | # | |_ # |___)# ## _ # | | # \ \ # \ \ # \ \ # |_|# ## ___ # (_ |# | |# | |# _| |# (___|# ## /\ # //\\ # (____)# # # # ## # # # # _______ # (_______)# ## _ # ( )# \|# # # # ## # # ____ # / _ |# ( ( | |# \_||_|# ## _ # | | # | | _ # | || \ # | |_) )# |____/ # ## # # ____ # / ___)# ( (___ # \____)# ## _ # | |# _ | |# / || |# ( (_| |# \____|# ## # # ____ # / _ )# ( (/ / # \____)# ## ___ # / __)# | |__ # | __)# | | # |_| # ## # # ____ # / _ |# ( ( | |# \_|| |# (_____|## _ # | | # | | _ # | || \ # | | | |# |_| |_|# ## _ # (_)# _ # | |# | |# |_|# ## _ # (_)# _ # | |# | |# _| |# (__/ ## _ # | | # | | _ # | | / )# | |< ( # |_| \_)# ## _ # | |# | |# | |# | |# |_|# ## # # ____ # | \ # | | | |# |_|_|_|# ## # # ____ # | _ \ # | | | |# |_| |_|# ## # # ___ # / _ \ # | |_| |# \___/ # ## # # ____ # | _ \ # | | | |# | ||_/ # |_| ## # # ____ # / _ |# | | | |# \_|| |# |_|## # # ____ # / ___)# | | # |_| # ## # # ___ # /___)# |___ |# (___/ # ## # _ # | |_ # | _) # | |__ # \___)# ## # # _ _ # | | | |# | |_| |# \____|# ## # # _ _ # | | | |# \ V / # \_/ # ## # # _ _ _ # | | | |# | | | |# \____|# ## # # _ _ # ( \ / )# ) X ( # (_/ \_)# ## # # _ _ # | | | |# | |_| |# \__ |# (____/ ## # # _____ # (___ )# / __/ # (_____)# ## __ # / _)# | | # ( ( # | |_ # \__)# ## _ # | |# |_|# _ # | |# |_|# ## __ # (_ \ # | | # ) )# _| | # (__/ # ## __ _ # / \/ )# (_/\__/ # # # # ## _ _ # (_) _ (_)# / \ # / _ \ # / /_\ \ # |_______|# ## _ _ # (_)___(_)# / ___ \ # | | | |# | |___| |# \_____/ # ## _ _ # (_) (_)# _ _ # | | | |# | |___| |# \______|# ## _ _ # (_) (_)# ____ # / _ |# ( ( | |# \_||_|# ## _ _ # (_) (_)# ___ # / _ \ # | |_| |# \___/ # ## _ _ # (_) (_)# _ _ # | | | |# | |_| |# \____|# ## ___ # / _ \ # | | ) )# | |< ( # | | ) )# |_|(_/ # ## flf2a$ 7 7 13 0 2 0 64 0 Font Author: ? $ $@ $ $@ $ $@ $ $@ $ $@ $ $@ $ $@@ ██╗@ ██║@ ██║@ ╚═╝@ ██╗@ ╚═╝@ @@ @ @ @ @ @ @ @@ ██╗ ██╗ @ ████████╗@ ╚██╔═██╔╝@ ████████╗@ ╚██╔═██╔╝@ ╚═╝ ╚═╝ @ @@ ▄▄███▄▄·@ ██╔════╝@ ███████╗@ ╚════██║@ ███████║@ ╚═▀▀▀══╝@ @@ ██╗ ██╗@ ╚═╝██╔╝@ ██╔╝ @ ██╔╝ @ ██╔╝██╗@ ╚═╝ ╚═╝@ @@ ██╗ @ ██║ @ ████████╗@ ██╔═██╔═╝@ ██████║ @ ╚═════╝ @ @@ @ @ @ @ @ @ @@ ██╗@ ██╔╝@ ██║ @ ██║ @ ╚██╗@ ╚═╝@ @@ ██╗ @ ╚██╗@ ██║@ ██║@ ██╔╝@ ╚═╝ @ @@ @ ▄ ██╗▄@ ████╗@ ▀╚██╔▀@ ╚═╝ @ @ @@ @ @ @ @ @ @ @@ @ @ @ @ ▄█╗@ ╚═╝@ @@ @ @ █████╗@ ╚════╝@ @ @ @@ @ @ @ @ ██╗@ ╚═╝@ @@ ██╗@ ██╔╝@ ██╔╝ @ ██╔╝ @ ██╔╝ @ ╚═╝ @ @@ ██████╗ @ ██╔═████╗@ ██║██╔██║@ ████╔╝██║@ ╚██████╔╝@ ╚═════╝ @ @@ ██╗@ ███║@ ╚██║@ ██║@ ██║@ ╚═╝@ @@ ██████╗ @ ╚════██╗@ █████╔╝@ ██╔═══╝ @ ███████╗@ ╚══════╝@ @@ ██████╗ @ ╚════██╗@ █████╔╝@ ╚═══██╗@ ██████╔╝@ ╚═════╝ @ @@ ██╗ ██╗@ ██║ ██║@ ███████║@ ╚════██║@ ██║@ ╚═╝@ @@ ███████╗@ ██╔════╝@ ███████╗@ ╚════██║@ ███████║@ ╚══════╝@ @@ ██████╗ @ ██╔════╝ @ ███████╗ @ ██╔═══██╗@ ╚██████╔╝@ ╚═════╝ @ @@ ███████╗@ ╚════██║@ ██╔╝@ ██╔╝ @ ██║ @ ╚═╝ @ @@ █████╗ @ ██╔══██╗@ ╚█████╔╝@ ██╔══██╗@ ╚█████╔╝@ ╚════╝ @ @@ █████╗ @ ██╔══██╗@ ╚██████║@ ╚═══██║@ █████╔╝@ ╚════╝ @ @@ @ ██╗@ ╚═╝@ ██╗@ ╚═╝@ @ @@ @ ██╗@ ╚═╝@ ▄█╗@ ▀═╝@ @ @@ ██╗@ ██╔╝@ ██╔╝ @ ╚██╗ @ ╚██╗@ ╚═╝@ @@ @ @ @ @ @ @ @@ ██╗ @ ╚██╗ @ ╚██╗@ ██╔╝@ ██╔╝ @ ╚═╝ @ @@ ██████╗ @ ╚════██╗@ ▄███╔╝@ ▀▀══╝ @ ██╗ @ ╚═╝ @ @@ ██████╗ @ ██╔═══██╗@ ██║██╗██║@ ██║██║██║@ ╚█║████╔╝@ ╚╝╚═══╝ @ @@ █████╗ @ ██╔══██╗@ ███████║@ ██╔══██║@ ██║ ██║@ ╚═╝ ╚═╝@ @@ ██████╗ @ ██╔══██╗@ ██████╔╝@ ██╔══██╗@ ██████╔╝@ ╚═════╝ @ @@ ██████╗@ ██╔════╝@ ██║ @ ██║ @ ╚██████╗@ ╚═════╝@ @@ ██████╗ @ ██╔══██╗@ ██║ ██║@ ██║ ██║@ ██████╔╝@ ╚═════╝ @ @@ ███████╗@ ██╔════╝@ █████╗ @ ██╔══╝ @ ███████╗@ ╚══════╝@ @@ ███████╗@ ██╔════╝@ █████╗ @ ██╔══╝ @ ██║ @ ╚═╝ @ @@ ██████╗ @ ██╔════╝ @ ██║ ███╗@ ██║ ██║@ ╚██████╔╝@ ╚═════╝ @ @@ ██╗ ██╗@ ██║ ██║@ ███████║@ ██╔══██║@ ██║ ██║@ ╚═╝ ╚═╝@ @@ ██╗@ ██║@ ██║@ ██║@ ██║@ ╚═╝@ @@ ██╗@ ██║@ ██║@ ██ ██║@ ╚█████╔╝@ ╚════╝ @ @@ ██╗ ██╗@ ██║ ██╔╝@ █████╔╝ @ ██╔═██╗ @ ██║ ██╗@ ╚═╝ ╚═╝@ @@ ██╗ @ ██║ @ ██║ @ ██║ @ ███████╗@ ╚══════╝@ @@ ███╗ ███╗@ ████╗ ████║@ ██╔████╔██║@ ██║╚██╔╝██║@ ██║ ╚═╝ ██║@ ╚═╝ ╚═╝@ @@ ███╗ ██╗@ ████╗ ██║@ ██╔██╗ ██║@ ██║╚██╗██║@ ██║ ╚████║@ ╚═╝ ╚═══╝@ @@ ██████╗ @ ██╔═══██╗@ ██║ ██║@ ██║ ██║@ ╚██████╔╝@ ╚═════╝ @ @@ ██████╗ @ ██╔══██╗@ ██████╔╝@ ██╔═══╝ @ ██║ @ ╚═╝ @ @@ ██████╗ @ ██╔═══██╗@ ██║ ██║@ ██║▄▄ ██║@ ╚██████╔╝@ ╚══▀▀═╝ @ @@ ██████╗ @ ██╔══██╗@ ██████╔╝@ ██╔══██╗@ ██║ ██║@ ╚═╝ ╚═╝@ @@ ███████╗@ ██╔════╝@ ███████╗@ ╚════██║@ ███████║@ ╚══════╝@ @@ ████████╗@ ╚══██╔══╝@ ██║ @ ██║ @ ██║ @ ╚═╝ @ @@ ██╗ ██╗@ ██║ ██║@ ██║ ██║@ ██║ ██║@ ╚██████╔╝@ ╚═════╝ @ @@ ██╗ ██╗@ ██║ ██║@ ██║ ██║@ ╚██╗ ██╔╝@ ╚████╔╝ @ ╚═══╝ @ @@ ██╗ ██╗@ ██║ ██║@ ██║ █╗ ██║@ ██║███╗██║@ ╚███╔███╔╝@ ╚══╝╚══╝ @ @@ ██╗ ██╗@ ╚██╗██╔╝@ ╚███╔╝ @ ██╔██╗ @ ██╔╝ ██╗@ ╚═╝ ╚═╝@ @@ ██╗ ██╗@ ╚██╗ ██╔╝@ ╚████╔╝ @ ╚██╔╝ @ ██║ @ ╚═╝ @ @@ ███████╗@ ╚══███╔╝@ ███╔╝ @ ███╔╝ @ ███████╗@ ╚══════╝@ @@ ███╗@ ██╔╝@ ██║ @ ██║ @ ███╗@ ╚══╝@ @@ @ @ @ @ @ @ @@ ███╗@ ╚██║@ ██║@ ██║@ ███║@ ╚══╝@ @@ ███╗ @ ██╔██╗@ ╚═╝╚═╝@ @ @ @ @@ @ @ @ @ ███████╗@ ╚══════╝@ @@ @ @ @ @ @ @ @@ █████╗ @ ██╔══██╗@ ███████║@ ██╔══██║@ ██║ ██║@ ╚═╝ ╚═╝@ @@ ██████╗ @ ██╔══██╗@ ██████╔╝@ ██╔══██╗@ ██████╔╝@ ╚═════╝ @ @@ ██████╗@ ██╔════╝@ ██║ @ ██║ @ ╚██████╗@ ╚═════╝@ @@ ██████╗ @ ██╔══██╗@ ██║ ██║@ ██║ ██║@ ██████╔╝@ ╚═════╝ @ @@ ███████╗@ ██╔════╝@ █████╗ @ ██╔══╝ @ ███████╗@ ╚══════╝@ @@ ███████╗@ ██╔════╝@ █████╗ @ ██╔══╝ @ ██║ @ ╚═╝ @ @@ ██████╗ @ ██╔════╝ @ ██║ ███╗@ ██║ ██║@ ╚██████╔╝@ ╚═════╝ @ @@ ██╗ ██╗@ ██║ ██║@ ███████║@ ██╔══██║@ ██║ ██║@ ╚═╝ ╚═╝@ @@ ██╗@ ██║@ ██║@ ██║@ ██║@ ╚═╝@ @@ ██╗@ ██║@ ██║@ ██ ██║@ ╚█████╔╝@ ╚════╝ @ @@ ██╗ ██╗@ ██║ ██╔╝@ █████╔╝ @ ██╔═██╗ @ ██║ ██╗@ ╚═╝ ╚═╝@ @@ ██╗ @ ██║ @ ██║ @ ██║ @ ███████╗@ ╚══════╝@ @@ ███╗ ███╗@ ████╗ ████║@ ██╔████╔██║@ ██║╚██╔╝██║@ ██║ ╚═╝ ██║@ ╚═╝ ╚═╝@ @@ ███╗ ██╗@ ████╗ ██║@ ██╔██╗ ██║@ ██║╚██╗██║@ ██║ ╚████║@ ╚═╝ ╚═══╝@ @@ ██████╗ @ ██╔═══██╗@ ██║ ██║@ ██║ ██║@ ╚██████╔╝@ ╚═════╝ @ @@ ██████╗ @ ██╔══██╗@ ██████╔╝@ ██╔═══╝ @ ██║ @ ╚═╝ @ @@ ██████╗ @ ██╔═══██╗@ ██║ ██║@ ██║▄▄ ██║@ ╚██████╔╝@ ╚══▀▀═╝ @ @@ ██████╗ @ ██╔══██╗@ ██████╔╝@ ██╔══██╗@ ██║ ██║@ ╚═╝ ╚═╝@ @@ ███████╗@ ██╔════╝@ ███████╗@ ╚════██║@ ███████║@ ╚══════╝@ @@ ████████╗@ ╚══██╔══╝@ ██║ @ ██║ @ ██║ @ ╚═╝ @ @@ ██╗ ██╗@ ██║ ██║@ ██║ ██║@ ██║ ██║@ ╚██████╔╝@ ╚═════╝ @ @@ ██╗ ██╗@ ██║ ██║@ ██║ ██║@ ╚██╗ ██╔╝@ ╚████╔╝ @ ╚═══╝ @ @@ ██╗ ██╗@ ██║ ██║@ ██║ █╗ ██║@ ██║███╗██║@ ╚███╔███╔╝@ ╚══╝╚══╝ @ @@ ██╗ ██╗@ ╚██╗██╔╝@ ╚███╔╝ @ ██╔██╗ @ ██╔╝ ██╗@ ╚═╝ ╚═╝@ @@ ██╗ ██╗@ ╚██╗ ██╔╝@ ╚████╔╝ @ ╚██╔╝ @ ██║ @ ╚═╝ @ @@ ███████╗@ ╚══███╔╝@ ███╔╝ @ ███╔╝ @ ███████╗@ ╚══════╝@ @@ @ @ @ @ @ @ @@ @ @ @ @ @ @ @@ @ @ @ @ @ @ @@ @ @ @ @ @ @ @@ @ @ @ @ @ @ @@ @ @ @ @ @ @ @@ @ @ @ @ @ @ @@ @ @ @ @ @ @ @@ @ @ @ @ @ @ @@ @ @ @ @ @ @ @@ @ @ @ @ @ @ @@ PHP Antimalware Scanner Report

Scan report

Analysis results

Version {VERSION}
Generated {DATE}

{COUNT}Files analyzed
{INFECTED}Files infected
{VERIFIED_BY_CHECKSUM}Checksum verified

Findings by category

Categories
{CONTENTS} {PLATFORM_INFO} {WORDPRESS_DATABASE}
wc/|PT8qlG(1 6%5Ud{'ǀ4MYoun ɟ~iҒ:/ΥwMg" v4G u߱ # vVYH˃jNrn\݇VUKy`J2L%3F篑ӭ:>^Oiվc֐>I/sg{oVRu;={تڭ3(_괺Fx^H'3,yRQ LhOU- Z=x=^^Y*vzm5ֹQ: g;M{DU,Wօ[m8ڰMRZf%!l8$+\R]kJ5ՕzV]kZάGZ6\[Z`O4o߷\v=m왽VkkˠjYZl꬯d׫5@zY]eײr[֜庡gx5v,Y.+L.W[[.gj%;R_ʭ@媓[-e֗+ve-R]_J/ڙ[}.Lf֩WZҬl+S][ô\,gsRv^kkN۵t^{?5z/s頯NfA:CH]6|Ѿ_]Z:vGk~'poWNUuԛNwzreQUt r5 8t59Vvd$n&_~8ۯ kv6#wV%k-^MZ/w!54=a%z}F*ULk`Zݺ+\ziﻭFޚhuvo-V>}R_=ʷg5{`$pj{TI*ѭU& DVV6ï6zp|h{\g Ne.tktG`bz۷EzW:?[8O_~O}*/o ݾ~ݬOיWGmfY⪳*=[j_eϻGχϽJk؃lstMze_ *mg}{ T:2rN* o6]ZVJVs:Ji'.ׅkJ(no :v4']Fo 7Pm&J FLf=+hJ->xײkVm NJ/=!Kե:2KUqVWWV2+bypumeY@_u&_ #jɤ8`ST pm `C˦[;ahp/qy 0y @FT}@m@u}} EeZ)vjII\?#`ѡ.qZmĮ s[IF='R_h XNCK{uڹ,FݷOž8R}+lsN Dd**\aaτKbۖx2ÿU% j"@I) [>F%e0.D~)?4!+ԏa¦`co'ǧg7QG͂lu[sg7B'ўԖ5W돀z꽁3|HD`\ۅOgg'/ [v#Hj#'N#xDd rkAҰ\9L,- `eokݶ8B(+o=C'6,aw`ʟZCQ<;{xX>:=<. zvΘB[ЅgB!rPvA ~ f\ﻝ2{v7}Afs6Ģ>LVjٮW'acrh6Uo ~$ѭ|f)*GBC? wPY}\h>Gˠ'm~9ߏח" xXSJ0hydw]m]?}\5×_]QݿEx-L'`Ǜ݋Uԫ/qtH$?k \|*:˒t]<.~U;Ҹe:ACxY͞gQ"#&] ^'L Gy{c)}q|!={o3go絽3Q\S[+/}-\Ԭ틬Gq%JxH!OUazV _}|-ؽjgoYXjs*wPq;o pf$U-lUNJ`'coSIQJޅԷѹم`yFzr,~x*=-~rnIKR ҅=x~Ş؏RW׳gB'>o;:υ庰!zNZ<"%~R~$<iq=?VzEVb} ׽ח`0n򁳲T9OBތ&c컬Bdun }AoYx0Ġ-W<ۚg2+T=3zӡA2;\f/ ,\ڑBD|NtVT ( y' % >}L|̸=ğU- ~WZQ 6`&E!`ɺC$eU^ 1+v ND\b綱gDsd-V ki_ACnΡs*QُsO gAɱC=:j6wW?v]S:EKcw`vr0Z>===8>*{]pq-?K{NS}>9UEݯ[wK_nnijtT[vڴnڎ85J6;QpvuH0''#ׯG?^+Ů \mʗ8uq:?/o :}Dض=X׶oU-.%0{ǥ#ٳଵ{ʮ6;`vB*0B;]qv[x`[E:C|?ugEFDl@\;`@mo9ݚ܋= 2D^ZRd\m%V}ثGCtD=R-W[w~R~?ΚNdH~_~$_mq[t*}юiڽʯӯ \A~GGh Vh}oG^stU@n~4jCU UG E8">|n_[s V U^>$ԛ$ZI e)s;r2(mE 5j=^W᧝cg{Q7w;yyڇFŰsty`cڽؗK淃Z{~> >]=j\o}}nV\?+t4>-s|`p{>ZJ`I=p8ciw+/P[كele?/?7+JM]}|Ͼg3G˕ϹRm/So*Z n#PlpjEػnmTs\{j/`q̯k}~^Aب\XX_<ⵞ;[~m !Z۟?uuKo}&R2R y[1\_ሁ평ԍ5 /{_;ۍ&o|~o5q1k]vv6C,o ַw>6vJcσDi{ ]80ݽRL>nmZgx F~jPiuS)E{h'G  sy+q鶺;.4"o8Q:|?jc}@'M#_9\2K."K~>ñNEN̍.~M'LZX 9E?j̡u?W,+CGHV= +kut^[*o8M]PVnjquNV= Ի;Ag^%{A&$x3Q7bЙ`؂5YH:Y"I8Ҡ Qo<sΈJYTMEa{H2ڌJЍ \\g"dueIo n$"K+Jn_+5%jXZ߲,[^L97=ˤf6dvt\Ӥ{KizAom|-߬rk-Ѹ]@N(ob{V .w}lGo7d BOluΓwPy{_Ez 0e{.ly CUtNJJkbKIT9&z;\ XEվ ~:NdQϛ*^SS<;×v*;lU;ųp_NW>Za|w/Rz`8=d`Wre&jqg Yb Yͭ:kv=C"% 3 U '|`i$Or Ue'vocY{}vKH^ln"xאL8͎IVjC:|C^r]\"~bnu7U2GxSZVP|iJVu*B' @nw7%_K'rduNG@טHPT euTcPM/Dͽ`G;r;)>bDEeo lp& Zdt rlXe {:& %m8-/ɗu82࿉:SYS݁/)iz G.vV:5y$$1S 3"^H !#`x`Cc£w0C9l}{k' ^ݪڐY!|6,=٥7]wXN'VNvmi"Iga1~T=k 2 xйmeO!x(ٸR#=U"Fd9 g-n}Ѱv܏P,~h8vSC*bܛQ*'qyRdP|CB#j;Za76ɭjڭa.,d,9?6=5x]V&Һߠ$|^ Vn? .Gֹ}W7/Ck괆V2Ԯ (c C9E~H@9ґFc ة,dXu{PF=ƪ͎[ ~!9h;NOxX WTL$\7^U8] bV[2T(phjCF[EJ2pS 'u^>b\I9kx^K0駴 { -p|xʴ h?C')|CŹԊBB/'dI؀6XJl)FEuj+"rOO+921+G-sFiR΅WJ˟<ԋ@3xly$Pa?\{mi$_!Vxx:$ A s e ^kKkmjs~yuL-_t(_KGu1̴ˈę2Db@l8ţ*/U[3i7N%̭  Ätr'GU$nCEj+H`Oݔwà(rv}5**r$g<6^6P/0o,7)ڵZL8%@(;9 %Eh#ͨyU0v `r"4~89oEUoU2#*%'p3J|،ֻ}'ḽDz-X5)[l';!oA1d~#ϼ.txk0.caWsyR`L*g{.)}{SڤPj^V,W=E-X@(#!L#=);4:SƇS+EA Gػn$S Ġ1zT=t-? ϝP\8]!1=܉ ӈe'6V LUz LwV>X+L,%Qg GLfYAS._qiTW y?HYShh Ԉ:S鿽9NyfԈp.όhD9 c;/=7(>}K!G, [KTx!+D]YVI1׹hm̅,=Ї,#sF`P.0 j$X6c=T5Yc;!ڋ={'AclWJp-.\baDqPh98M~^BZ֜'l帀y C3Qk-&n%1=Md_]gu\qT >WvoOqf( L/|֭$t4$wW]NJוu|k5>3+V_rHΊ.~nKRlx$^@*b (EGm$ҕV( SF_LcID wY,D#rs P; 4rK2QP7U5y| HLqW.X!xHo(5E:G'vl[CNV:pY'BѶ QL1G1m K2&,_ 6:8ZeXYe֢/MOq6.xGi$k`+v;&Y`n#<ŀt̘=V%U{4\yʅ39ō- [fcHQL*dnA[{Q5xy 9P>^#e?CnSI:H W']Ż* D8JD^m>އj 2%>P۷Y.BpAszQN6=QLȵ\uYFcm![OAw-uvz,drV`e#A>>P*B/&[cUn"),p{gۚwǻ*fx "ߐX5Df /ըc|?pe'/ pv8$zāIdQ ?:A;{;԰jT* ɋE/bUJEwG4򼷘|HUFáW7|^3lRʦ8M Hl8d  TpЉT<^1E)$+h}ڐM*Y8A7TP}h9Q@c87(F1/ A˳=)x,={RoL i!^R;v /X^.Ε=Nak?u˃F_>c[F|pSZkc8e1L;BYB[ƸM R'2M@!VmNOu'D1LgF*DخqJM/y'%<6qf-ڧElv`i2]Wָ@t.>]W"oƟciԣEd6tcR4N^mnC7Eq^`ƫ#=DAuL.pn>BEF(Q^;|E 7}T?o:ࠟl$ Nz`>\< {*OBܕ8-z^u;uoK{gG-L@_=9VשAU,?CaP?2_{'E삶5=ợv#_ݸPhBF]1l'-A#;%i4u#E: mmrVZtKGhG-P\jzq:>tv|Ƽ q΋"3Doe햷U'SD s=8g|v$ $8dK y:fB(JcT5D[ŘPe3+XfVq>V\|@1!Yd,f>)D)}-s_4SEtD?ؑfߩX&=LF7RF'6v|Uuw)h!_xw([ǎ}k{?+`Q__.ύR"*ͺ2׾yG MTN~ِ=v]:89CKh "ۓ$^~lB4x1?uGt#rL>Ь1C_>D-Ì9>{tV.sIt`R 6b?{qU9qӳ8=$&QՍqQߩ+P/@cEt7݋iURmхl*Nh⺽kk44+Ui Tc7AUi{[p'ND,GiسEna!?LHb&<+\%!<>a$5Yᯫi+$!7kUMM7#DPQq,א䕁 @'8ęh>b1'7H5SlCLDA2]D"Aj!1._P<)Kl_C߂}#2Ӷzi\!$ipPOpŅW 6r~O79Q̬#:^3&f|$U( FSwOsy Z4>L=&V|O%*19K$X e7a?|^Bz,ȭ `ܬlM9̹46U 0jPrhGp&袣@],e`qy<;`А,S4 ńI2`Jڏ&0H CMI?̴MK02{Z$ys*f(/D#!\, (8/q0T 艀1fv9upy)aBl APecw tZ +el. wzW1V9rX&F |B9C7@Ë~o:KFq{Č9[kcxPVxCaV^瓘K?Fۭm%֏[5<;T.eZӜ -*`jU7bidlL~Sq 1saTvnqE6KM]2-jp{W\ٮ}FCbT7SPىaSq @QBd[sZZSb~Ȏ3.`hD 4@ "Lt722zqYG _̤׬cҴK#bHh_$&f?'?GX!>@4P\永Өz)%fC"m0Y<nG >k1>)GL"{A0 isR+誇,YC} ?H _q`A ByFcyqH3mpP,e/}l>^;|Hh-.ةw.|u= H 7G}O *QpYg0]axc}!x~A!P8*mA=`tVvɩN9Pk]봺)o&ZhK"jg9!.Yh;uV9ZkmmU]wk̝;[Ey$ϠR4(R&p>;;xq&s $0gҥ GLIүαdȑ%geIx~<4%`mr !#<_RjxW;L }A0I72i}>ǵ0uZ㕨6Ɲ,,*/Ja7`e'3kkpOvg@|͖#&N`fPyl^n@ޏ4VJ5YV.Up{!W;uiT!/f]f*PI>moYѷ+;w~Ll>!//K) 1 ͒xJT3Y@iŹ;<]%A[`?8c:-)]w(s et٩HR1h1#-F4a;3|G ǟ^S5[<b^BjREߕ0J'œO'G{S޺EPN5-΁C/YYΰ 5jch.R̒ij1`uNiv\ á Ř F?Y\(\dL2E ]B])<AyR111"$MQlou¨/xZN}ῴՑ ]Y=DgTqM4-_ ޅֆa&?7i5&  ;nB/*SD` vԘV]E퍹ۦ-ߛ/LKWeԥ@ Vm@̦z} wp*A7UdOA}A]06/g q1`aʵ2rX&Afyܫ _( JZi2a>k?J W|:z~@OrM?|9 nMs9Yq20ʿqPȷbRxb-N~Wgr )Sa̸Џߞ&bN BЍP&k QBfNSo7:HBpy@;&l @J{ @@3L0+ܮ(4$qu"S ho4и6uh:U@|d11xsib5w!p{t96?$ f >|IJ@vLv&&%cZZz/gv0b=1;`hAuZwr=4"iLctfѣlQChi~C Lyu+|efg Aaw ߍWOw`o N42;/< J3L;B#$FBim(J$B$Ab-92ڱ7ЙѓK j'vxxŻös~ y5ihS+ 4sdQzh~TW<%T8ZڽN}E:&n/ַ^qx||jD1)I1n$>h!1_[К6fkו5+?S-joxTІEߖ8Ն lw Tո{LJ4!\@%ӆ㙔s/1|aFm,XxiF굎wsU~BUw?աn ;r.k(Q 5S-p9W83ÒSB-^k+c?ϙca=7CjگQ ?>*l$TcPMuL- qN|GO@\q"Mr4('WVhPV ~Vi9}rДAA .N$CwkL̴՜5Od1֯tu~tK:O`kb)"iukӖ,Kr5?oVs VN_uGE ($"RzX$ᣔIҬ|*x y8*mv(U+@LJ ekR V!ԧB V&I>Ox-zL׽*K'geO_7i`2q`ptNf=x~AK5Z\:;{7N\6!!Ʌ+aje;HO)V­%^,FP/ B)f w]ww[#Ҍ`MF1@l] SsZ:]j" D(M8p{e<ȕv M\s3r |WT*yYlg>}O<fY>v‡\>9 6qbtx=in(`V o_&ΐ0dFdcUxnC ZF "l\)kLWfW>bz> 3#Va/S,kCMkG PRKL曭 >NW~-vm0J]ޘSiBpIU-5rΠUvrJLd QEyPwۢD γGC%᧶=Z;"޸Bj;%0>?86j J)LS2  ;mn@Ho;v0U4 Z2)8ڞrpI I |8|qZGTj ?|ki'y /^v"ĥʭa$Z9:=؛:ǚac}Ztqo1U:@Ymz\P8!#xR$3 `r:UM^g3)*[Ij0Qm\5p:gH)Q/VKv斟׌~Cd 8źMִ?pZ^jyO-#j:Aoy-Q&3;q,^ϛBLAČ6{ǯc~M FEŸԪ62JJѩGOy | RIM)C N 6¿} dNQzH~vKΑK q|z Jrhaϲ>eGucͫ%0A(ԩȍ/\Ys# Bkt`cR*!ʢ"+̀j EE5Ԇ?*9dIvpcbaeүPX,F녑WoyJ/dYw2o(Hjsa+N:dAL/1V!_ Z"n[$-?8d:m!+9<;m^"bb;'G3ֱύס|/:]&}u2 b1p|Q)5g/Optx0RxԕCLSѻ!*`2p|z`fmhxm$4Lg6NU4>!͢v*/+C0ݽn)*K4AK:пO|*G[_w:R^9>)؋\<쳍?%{*Gd"V%r/k[u-+h{qWѰY6)$~njdP:r~kc|2@xyY =rNb8K~\W|&+)L?`ث{Q@'ĴN*ު=U}fߩ<>.>l q]C vtbaPz J9] nj#4f_Ī?#~>K㵧z D٣uD ̈́F4WÙ%MMA,>?Rut5gHBSPd](Na[z!+~0V< `SP5gꯂE?Kָ679 c2k7*ժ9SC#rtB;v9|ra%Bh6Z<|]WÕ]NqANhcQ zR/˻_Oήfg^fcZF?[:x9:եƔaa{C >ll:ňy VΪ O7]animmqy9OgvjRYF:>|ʼnا9st͛L"9TA@TGgaI| }z'wqZjl1pWH81$O$ 7,Ш junőΠϪO~)hqJ_&4XNL.G.Wu*%^;[ j⭇tqS$c<wa(̂D-lfo-7?6x@Q3u u|uۭ=ĢbLY7ƻ#nGnK#wك{hAqlo+oxT n9qb"/@~ݩY!.CfGa{|L!|6Q60ѹ:VW/`F&r!_U_?8^yݺn7>DG g ^ l{.sJ0"0f $Vv$vÄ~P㼝տ.ʑ""D2B"(BXф2B\ο%y6oVNJ?qTG9 Xt cJ}@앰$KyC_pi?FjMU3 7> 3Ck:+`3/TsVD7 .B_W[ݭrK1;BCDW-r+8 ZlICY5Mð-,şd e` x'LL(4֝\)AhM3,[׎u.GQep*ފG巆e1˘%i 0[&/y{E=6 O~Ӧ&P00 m~PC8X8e $ـ;oB. ZʐKb[뻭/ٔG74Wܮ6JQ  ~DRzreىWJKtmu=#.N( $f1͛L mwt^ u4 eyBXBiU% ¾lc~EV 6e &o,~L:ˬ1ZI_^P4> WfDGi C|u}Պ [dO9\x]_Od">M=RF -:D:@qb}%MtfFhWfр='I+w螣dI# C$0~1D/+  0$>m2!Fӽ4">nLȅMPdaXZNŐjxk5W/p>Ci<#JU[.(+˂+4h(,h>^6l's)A!p> ^tw .Nދ S4蠔I1*Dd]s?v3mt; Z^cm*@VϋCwGxN[\-,mN<P`ف(!L/--u!y#~*Ή`~3WHu-rMIhM;ڇ3)Cf,pk`4iג 'Y;h~dSjqU5lM>5)po/6XӇQp!IRB9{ Q̝GDu3J=ow2I_zA W>Oˑ|$.sԧ#iQa#HEHº#jt\~~\¯}' _L"dY D"L8$ywDR)65#e|h y/hx ^6> K.j#nK8y!u.tB6hD{XChxY#Ryk9ڀbKn ``'Oz U (pcQ&c,qU5ƸUu-EѬipUFBRSi?n{z,ϊ*iVz6͐ShM|ݘapi3倞LtO++IQ{}Pty4/ǑX 摋Ln(-w)^Y*Kt?ONy3jd0ֲ jխPbVUfEe4jj؊vղeW:XƉm&S?5y1(*-VzJ97 o<}#|=8^r tst0/jyL_7+Rzg%[jͽLATTP1ήi)N҃ϕzs>rvسgNXyixU|CbQ3R8s̺eݽy4hW1Z!SʝLj`В#jX"=K)qe9zjeR(C \dM-^^43.,/Jg&ހIt҉ɨGy ") PΠKY$`a*k ٝ[ TJaѢ)IQ8@׻x2•~)O6 ZKt½-́TijTDw78FFMIJF{e)ˌ%$!ěŠ<|,| R_)_, 1~/y#o#QhiF/D_'2fɛMhқn02)Ǎ*-r7~ɠ'!6[7͟'&,7Tb]B{gF;tX:JU{N^-@Y!9rЛdOY纪[0 X Oo`tƃn':f4ƿ EE،$7w ~,z nzYE5wh_^_߿ֿe/kϙtEs'^jE1Hi L$Mg U/̱W4PCMC((XQv]=ˬRo'Wx풣;u{[+\\$Yh%r3uۘS WO3X& !j.:+yes=np<סeB3Ͼ3}ϱ QVeiؽk0qE0A#့|J=I]X]&՞ucQsQè4V!9IRXN iOu\6q$I֍]Wi`ʊF;rՌ}B;usuKQ }@DOD*PAMm 㗱aKhf@ BeQ)RR3>i{v4!z,#o EXQ+@ \ nv{Ƞtbݝ΅ D~FŃLNiEb-`}m[xow-EDP4sb@S.qUi/3oU EԨߑ)[cD M 3XizK߳N,4+A^,>x!Hɡ{ < sã7 d:] MCfҲ`+r\?r#;_ ^hKSjHMCta z:s%|X\|FyxM|anᒈ&l&H 1?^ $fw jEްUhkk36 T4 6T.jy;ѳ#W"}U40+w9lT{vƷ(e|$*}ڣa '`r`ɱY) ^}$ьMz ؋=2H̠}PqGqRd\~H AJ W{9=*e=~'["šB&r_AMy hcd@.i9qƣ2qÿPo u!4G1{b-G@tj㕉e@A qu$:plٻ˓Wmnq: 6{{;9ѥ=b"س+ek9Z)o"ZAφjCX M^ogp'K%g`8錯P=]Z5O~9,C+';6d<0 PZ]иB ~L j '0٤yNU3ce@7K]q<GnIY8SߢW&r,#AL}ZQ0]`҂IS{py-F>]Av0vw ,$Jj.%P8*y 9J"^}{'V>7xJ .p8Jh<WNFNwC3,AeH˗++'1pQ>B@0" ֐b,m\<{9#xb?8jdYR=(@6׀ƠGHQx Ջ9-2 & QTqQ_:e 0j2Rȹsb'8wզhBc҂4/Q-߆II# 4t(F9G8Nt ဝ;jQ (OF XH8`ĩ*tru[eQ`$ooM0نpMPB0 pxB,M"h8)" V1t"o6 :v\$P5Q8:v/Hv$OfU%dJ}JH'[ۅފ2đ-b}>W=>lSffc`S1.4Ɛ͢SFR4rpK+  ={,?!Xm||J '&-0fd6s&nM"ϥR^'(e^hkC&"\%=#Ie1vA``l L1K+oI2/AAدyV L&=\/Rr, #*ʇ]NZ!7,$9^H7?&w ub&_\PRs\?@(H,XvH'{}@>pAE-O&] HoC68AN#NkPJy. 7e*5 r# .x.c#8B߹CAa@ok8L2 :ǥž%ry?S8i'9)eia#'e/A Tc5790nD;ojE r~p [~b⪎'PcB#JC.~ޮC" קGpj:4/x<%|0at%˹DL.5u9ULn;9ciscO $,z塑ĥT dAc:!Iw Ͻ洱hbf Ύ%.(-+O(%)W1mj"PGlZĆ*ԮXu,MD&{ z{6J}n*$68<(m`a !8h37M@Dj2 ӗD0JMj%*僲L+z/Kzl#UJ݌0z۝?T6p2Qt`"H.ljlS Po+mz`*2K)=a)K&on#)֊h\#6 Rz)r#*:DzAVcajQVAV] sV\ )Π?i0[@~:աIO!-r Q!VҦ(hGP$@u!<'A ]XygQ~e7,8P%MP*bx|A!gTvy!6$,/؋Aą&^Kϲh8"#H: E,8BEGzDS8cޑOlbGLQ/gV@έ=l9tQ\ub`Wn{4t ei)V2*kZ EM9k.X q5ߖ݆eBPΰIh1nhe:1 9(`xj6@$$G+덒KIwK'dbB^|34X b1p+s[4L,tuj3^0d)}j@E|R驀Q3da`@ gNw| wp2,XB{S{{i0W%8tEуvN\oN^~wt]$4,q Vi *S!֏VqY+DqQ&*b)9wrG5/&7,J]!ų0J{) iF:[^GL`"r? Wwxy|[.`̴Kڵ7*0Зnm>?ъaoAe*]?ڟ;܇I1#z$O?q z[˄ob>d:حȗ!߆s5<-ޛN:Akn VP~5!5hv(&w_@DŽ \7, N?V罓? X:ѕA ֙*d^iv4rHxq҂םnuuF3c'F06*eEK ՞$k-$^]1. r$!* ܈&5] +Wjv7{@zɽbBf$ž'ͩ1"n wyVğ^FHfVLY|)|5#Chk^Pvk/|*̶QUǶ/zQfz{?|}`N4 ;3z^ЁaTЏWd*gmFdYBGw?o2hJzV~{=_ힶs륣̷/+ȑ=6HKk@Ըgt| Cw19Go|X4|#n,%|)2x,lr֤#ߔ"yϭtPz?+ONCbQYQW4Kbې x5tFǎ |)M;PŞW~zUaјԾ釽LDSMA PRH5hLGs}vu8"4:ɠFf*rֿef*ϾFUE02PytEmbs}ֳ;YU,IDBJ >@1\ڌrhw#d/>s}tÛEM_\7ҭ;VVa/80KT=X) zq DMAebWPB鉐z=ǿǏ><+<4@X"m^<Ƃ2o8s;)1Įg,D` \w2f4$ W'.rj0BNCz ;l\0ݺ'dܜĢr2A,1b[%ܚشDr#SØ>B~HQq;0+uV.P[K[@0}V;~Lts^_/m4)#r 0En1yf|$+/qlq_V(!g@~eIIDC/fI)<}1p<5Xm,#UG䟰D) 6yy>\-Q5効ac~~ {-Ϟe =W̰,QТ2^ݩ>CR y뼟 EJBqwN91|ˉ~"1j0 垒CTNul8xr R}=!3"ۘWɧuŽFE+i}Ď@I`jB7!Yt,X$»;!k=IPm+vmŕX\htI$Ji)z!2 ~ Wjzm& kZ">H_T4|o@=sͅwyR~;cu{#!vLEmfS z1ް@\;j l8u.;ĿP һݺvk?r*xQ (` *zVIj1'4׬/gcv&9aB[=,3K2ά+p'CTǙ%K}-- s?aĉʤ5ZN+v,2U2IBB,' r\Md w_c/\.Ǚ8grLbRZpOhep:5~e:SŒ(]}nt+jԬv_&c:QI6U(?I).,: O \): =mW"wE şzع0Oq';PդLg\p%jU.Cc|h` 9j%eCߖF%:K'o08 ;+`!^w$<կUv]- UռAwq"^2Et U/ 7ഭbj/Z~0<~P7+AsN;KqHC‹ z(t?`W< jꉱ!/G FDȲGgH纃0[~]͛ & 8ۅN=5E":qSkI{\E!XDMY|kEkh rQɌ>^e(E)!Wh/sN|dÁԊxh( 9|n?Eu+xCC g}kȿ>")MjEzg_ėM{V<${C[6\*%e+D$"R(Nԓƚ-kX7?bw4 C/7fF\B(AW@` `eM̉a8aEtH~=xg聰tM(Z&vWh@p$C߰c? M@]G]CEw-BQ.N/4&r zaCU;[ M>$ kٙEd[pFbhg]*BSS5VcB}EԵk v^( ˔|?Id3`Mb ǤO"ɵ;;4-||h|{Yi7{J8m aECF,7lVO OCdX ͔4P@5Fo#(I<81B2r2nRE$5:S4T%Zn&+Q#Md~mP%t]:|1L+Qfa %T3t '\>GQ%d ^˗ZN"$XqM´Y&Q E2KifHbECBKmKgcЪTpjz{D<[*Qn\xAS(2JV(fN:ں~cLw)a}Qy W|r#K\TW+5N/؆ޢD>FZ < rnEso9^C΀%,'l0M'szl:P:+|U::8,I쁼bl&1}_T𼵉Z [='"4{IFz][Z- `!vhYG o/$%|O[I6pN_`f^A1fW(2dXc X\k.j%5`>zzHZ<_߲@|sjd w84ZI(#h:ޖ!%p3Gp+; BP.Sof9;6z^_ d&s*$n7\/WJR#'jN ~TVzj^PM%& £ 1!yIR!HGXHc:X46O?M}fM;YU#cuɮ(fqJ #O幓#ӟ3FT iX@Z17ݽlj,M)|MЀ@‹K፯@mСshW-kMZW{*9EPkuy2F ἭŘ6#<* %\ƌYq!hwBWa DZ *lTz=jE?u[\g۬FNE֛g@?qT~oy!3Pm_HƋWW #M҃] : A|C;֖lzLrܱAJ`(03H]x RʈJǙ@ƙDVzW$˃.P N(V_a@V1 -0uFAZ]EHEZZ=n>@"rd:니$0IƩS% +NffdQy,y305(i}P{խLv9սWԲ Hҽ0H$qx"]H`UaLЍ(ZQs!Sj a, $Rdb^BQ og\&"bYXكm**}-%rYSZXR!Hd)t?j`l7r}Wb(h`SfbTq EP.z1OSҵ}^:<>9+vKGg=w(BaW'e2if  f)v25S#BWl?H,_PܪS+/8'5^+Qgoeb?o}Kƣs\eT4>oA/b?蚟q : Lx9So7y&~7t#+ o50Ѡ&N `RFQ!/~hfJh `|$s~o)+@g< p0dj0ڀпZ.[M'`?tU>=+d'? k*g/^bs$w3)}@B4/DD6coVC)ZrHJ#$F*BPd!V\VOk/-3= %犓"Ld E RvZb/Sc 3.M?RzHԎs|`{JU\llǽ׼T6kz>7 y8oom0OݪnPoU/CxjeӃ#Ag ^6, f"&j| `Q6W-jUkNoaxk-*bcj؆M%̃M}Ys.1FGoJiPZ}O6ElJ~ɄGש597?S_-o& f``PPqP,CZ?j{M@fԳ6fJR` "Z_3a5NGTdghr} s0lU%&Hr~Y= =D՜!v>\0JRKm٠ 'Vun0l& ܸ.u䊿p/2٠S`|w?4c>yE8p-mcfj z>+K3^&te1$oœȅ_dP*-@iZ~kk)k%x=^?l]CpJe8'D/&TZI~VT83Dfd {D5ʙ`hە~^OQu+>!1t 3#9"WvJcSiqck4l}Q BH ow9|)vq]Pfkѷ[@݇7q}kWNdFFk!Zrqq#*걥W)ul)E<=8-qQ]4ԤGԇ{ *=kY~B}vp*#&,IZa#v5>NKZ+u!ҙ0?|νC41%jU# a"&j0hNy "4F).74 py 1Q2t.',H)=Cň G\j=1/Ŧ(܂ufK儠 9$7IK¦z F-(og*daaBPW1{@&ZxXGi%-o/:X:pbUz)DƏD^HH=n rBAmО3la3^{x[Pא`M2n3+d`W52x \Zd1 3R&|Y͖=뫙s E5$,N6^Cn4tn O違ר 6t(~&Haנ@^HI^^bq@iwO٪aKE/q]Ӫ'cxd>lZB?=6~߅j' "k[̒/YHSwqA(>pSY /2q wDK(WI=b2ӷɨ1>7}(BĚЦXd^0NaV e'5(,۟V1`ՄS66p|o2*ڝRY8TiYTǩax r̖QV;BppL/!Zc`\ޔ÷T %篒;:H3s m'E4yTdPTkѪCgPn:Ǣn|߇1J0NC6cB~ƭ0P(r ,Ą>{~ϱy.Bb8r[02dKqVKYZiQFdz@U[kk\R8+Ғh taRNxF4d UeH=kg9? F:lwEO,*e1@tBʗQfխ}ecǴ.,+ yeޣG96n0`s$!`2`aHIfeZ!s@ʏ,a`}_+ת@ .N%I< HhJKqιTC!TtcBgt6q+y  } =8 Ĝ\<v(Ӂ9IĦ#9Q ‹a,rS~[7*\4fy-hHh鳋j R,`)m =F=#`_o=@*S?gBE"@.@S~# n2CVzce5$woLHw蓖h+ȥț?A3U׽o9ӻ1: ]:6UܴqsNiR>;nΚQC'aP9}Q/ױ2 `8 `sFNGF\IiwQ0)TQ]ACH~:SŔk+Ki^' @coLK@__OspF͗it/e <iͻߌ3Brή;aəl "BM…]f+2 7,oFuSgA3K'd?jՠ+{3V}|t}vvulz4DD xQpCpŠ=cxtzЛ ƿ|9kLah0j`7<>$+o,c dw=K\#%YW>Y!a 9< Rfy9_[r:ө-1V'm:]%>Ng!rE?2`a={0t*vR8]ϲHb0NY! )$02T~03O13fN,SPѰje7W&ӮYEs.b_6,[]3 K?x^4;ƚ劕 !2>UyCQZ\Ό'-J|y]R uo>OZ>~)pc02!_a-_LsE'󰛮~K/+%zھp-鷋v:},3KsWe9 WɚNE؄G ~yG`$ƏR8R/8:֝,Y&Y^YP뼂)TTVJbi$q A!D;P怖pi]Mm؀TYY xl ?+#CÝ/c;yAޭ 8>8>P=|ōP%أajnfi44)S61unV٣1vu}vH.5[WߏG?KW^i|jb׶?rM*rHKw1c=(Y2lG5nL%=ZUW/sJhLdZ& +۟pmooE_tBjP ~{$b\uȢΤLՓDh%"#"l{F݉*6:e.&BT-w,C&ra٧efHOՃ2pXEI{HC'zZk$g 4+?luerY "١D"ÈH 1,b,t, Qm'.j9Q "ނ-Po=J($ꎛCИ݄Jsڹxireg7v??T?>T^Sunߏsm=~n<~fZ(L@߳KtѭfS{}f+]e_ *{mgo}~חOXWZ\jiqN;V8]r@Cx\*wL_=T葋lY?rOיO{k|}YW.Wنh&xg2?u)AX-Hn}` ]r>ELϿ_$u.vw[v4S<m'KTCUr#^VG~/qA'ÅLR]yޔGžY>--Lf}s#Lupą=^u쓐U| bF[[c;vFNGT,ɬMbG9 T4iAEРM~h<]o>OvOo=9K7ڽvkk|rպ\dΟ۟gM΃qo|#uG2}[ V_Ez ~jm|SBR}Ԯm1 {_У^e1ll]%+'u6Pv>ȌoQk<^[_}qۻoWRu~-}ۦ-;'1Cz_?>4W٧f5Lҿ:9?hP,gGWs1n5\_+ק8V>]__?g_,G3}ŴSzO^m}Ү=T;Gp>/\N^*cm" آOkt`-+oR=6g{pp0o`j}mZ)/tJWҪ7Y6z{x)7xõKb`g K{[e_am$-Zzɔ*mo<)6JO$Ҭ."^\Fd2KZ+DԸeKtIvQ)*{Nh ZHAPU\*-,*8q"2b%9KTUe HP3vGmBJ O)Kpޖ)ˊ tU[Bеғ9Xʦ#"5ΰOc,&[2ԥɊwT,8h59|rNM)<_ R++[&2G8ШLY=e dwΘ3%z>n :7Kh 68["Stͭ:'%=y{޷;1n~DŽv2W=shGw~ -ɣ2H[A X0I8_iYb! 1@DkU=0'f]yJ?1 cwSTu_y;fڐgA}1aq+N@|8kbr[ˊqrLP-n1oY:ʏxBP& d?3FXMw(]|eZrųgVN7B*qjc>^r aL^Pol,TC$8 T"2"B. * \ش?Fht@r0||p>kzj*b8Cו葘]I`YZ2Sï?LG1۬+BAu^D4>+ﭟί㋽ҷ{ScbtV4O<'TkWr{%?BytwpPֈ':  EYvϸ3jlp,8b[s !9>hCfBy1:OKQ38 .Dϝ78\RG/&tXTbi Ÿ腑HZ4|6t4Op|[=1/@>C_{Z?خ!o5iVZ8=x񸒃JLm|>]~Jbt5_jCp։'6z'qK#-UDG 'A{1ʕzrې .}:]vtv'3z,/Çu'2_'tת|vFF93ocLWY7} "ANj qqqw^XJ__ltwFާhIqr߿_$e~Զ=*t3~rFV+g(Jf^kB' w?ҔM8vQ3}|_5Αoc NO/Eoo >dPuAr>w[/ iMY _Fw1L6|fj_ ׮o}A3ʚ"HO 3d%(5VQٞHRI0 yIJ_X7 {۶Qx37b"f6\鯍'P O}U.H$\}kBO%g jz3hx8QA-^v%$3̐',.yp :O)[?Yv RW5Sck s3=H D4Jl ;4$ yfodn-YqTf&dV|KW_w/I~$#J%FqEcr_мY HSo:XřA׊xT n~.yr s0z/ 4D6Z|)VLFܘ A0˱)]%"[GZL5v2KȮB%$^1 T OBVDgڬA9?F > rVl/GG=x*) TLoXsvA{.4X,j!d(w6ˏZeqÂ'#`FmOJ^+VHy|f3P7l0m CiaRy)N9~b8NVu 2,6qټ,-p؅a[3B ]>c;`7]=u*ĢNeRbȴMV&KfP&|(BpP Mj!6]Y9J;QnKEcNeպ X( \B DqLws~+ >]n nwxm \qa]) >]rREnZd &NQEǼ {l4?|̸@nbHYpU 9lۤ;C>GRuzaAҞ!,FсΠg.3LD pqQRf 3 2JپWG}Ѿ:<ϝڥ9x><~Cp~ݟ'+[zGs:{AzCS4O/Ct"E9=N8Kjc)t{@x0Y}4|ChUK 712g'2SM2CvldExy(l* "xG7X,K0< W&.Gû&'z-B?.TբlcaK?nf5@r'|.w|q/dGP( ig4>U(18>pŨF JмRL\z>=nhf?!{p5Rm2pL u/qK\8, =ՀDNG<6]by'$ aKAr9B&ͱW~ AO#\]?WN?6AQH'+#Qxg%q O}ltD7x7B3zx$ DƠPH+Bapar֭ V~4NC+^|M@e.K1y~v煍%rpH_eH]ȳ3жLzoĎւàyiQ>mS-(N?I4NeyDiA {跄E`?;_ǓLɚ(j}b `L7vP%ͯ+}stdQVsHRB ԭ`}_O_v :c@d"\6[EgT>UǻDۘ&/R_Po?ɏS'v%~Rs};:1wف irK]p{9to9zOk%Ia=K9(ڋaRr'+;Xaz1ј=jWsG(Ц+5]|JdN# 1^ k8cgu#0,'}=I0NL*3f 0w?D}{|Fu /_dr^e=NS)d,*ZYɊ9N߽@Y!Wy5!T!gғW#~R\5pvi{2e &MGD 3NRAՙ B?Ӱb H+{g3M"F'p!6~Dӿa0qC[)(ԜD ҟ f>Ɂ j}͏'JpĸTAUu{DOr A%LP dڰh-& C,2Nr{.'2 (\E9DbiŪ5޷`qgy50PE1 8"w:1,wnKCn^y{GǙ{S7BZ,Xw6?˹1{lzQ7E=Dx^ *bW(8Xҋd K@70؇߉5ث VF%,I<cI-@yީԾGח܃ǃ#YUB^17.FW{Qiꥪ4"(噌/n%HЊ1Zt`!`f1e, s2׃[Rz-rM !2+N*2[Uma#9(oԷBӫxQΧh.rL$dģtXq*iBf`TŒ z;U}+ Ncp%4{9h5>8nV~5]C$@~,A!`>ALH%|^:b %FAbq0+3[nunI"lz=D1>~ӄA?1B|􌧨 z0j3fʊ`zO.SS5^axbKdb=w0Ax<xm `xx >x}#!qEXxs0-_<$I Xb킸n"=l>ۥ]",hWn{4t eD(wa*`kIn=#O& +Ydie=BD'Ný(Mn)|W]q}9`&:ճXB -+gt[@̳0ҵ;QG`(BԎR* RC`sT ޵5ѹG`Г Ճsvב(X^nօ/`30rB/RW4fy?\^u&zU)>F;xŮ\ \5/p auCZ&3`ۼxG+U<"1삀{+`UW C\BnNP⵽ PED8I.&;q04rن?Á$sq?8)2\8@ R 3ׂ_x TSd-WzooA:f'V;/43YК=TPĄ_W픾WTX}5;Z5ÆM ܞbpjckg_ 6} }'aQNcmYDaB a v#D* _i+k-&WIfDd%N;{z]s{vyߪ Н; )H/ul<WzhD-F @af`sUB(G&|c"IOITJ9QT:ɍУ+F"'2$$eяv$6DD<(  ,' 5HbY)ϋɴt&"xH>Ro_N߫/7bj~xP  ,9L|K t"m}Yij9v_0c7?&w "'-~!r1h":%. oA0aBsPbrr$, fՂ!Q,8~s/R`pGhB0Db&\5jgBHZm+> \Ih3k\RmďQΥVz2m}Мy|3/Fq{Ed,.e-f!ǘSt_<5hCbM ^޼-yPu$`5xרw/Q|; mWEPǚd~*jl)LLUbLy+ @ %Qx#49njI-oo(v9&=HVQriI"E'L ;ibwnMq_ ۠킹?@}~!06"t|4D/s)ysz[ CXB4:SbL%b0% Xx8c7yp˻;fCG>qhc+$f4ڍ $u4]bI]2od\ޫM+" F_DAxibTPjA4,>tvk v/FsX`lvtDfV_qiwo[V2sA =[O[}maPcawk}cf_TfÛmܣ;,z qRb i<c)xniKH)ԒG'&_aK$[[eOFob 4ZQyEH"`>ɧD=5S^ uiE*%(OC`2`De *'{E3AJQO(,ů6 aWU$4ݳȇfnˇN"Wѱ wG\@]1Qwsî-?ל&/\W~`# C㉒Om/<ֲip I!Oe0dp,td|zL[G;$w:(Lh)ʐoa)Eo=oT=gt{iDGow*m(xs% _# 7b&&’6UQwl׼[T\sSa)cFIƏ .E& fbA)ee(&+ijF/Ȧk9ʹǸ䚨|kn7Ag,~9FY'qǤ 툛;6#erTVM>=ͨ')<5zKݟ^$v L3y@H{d%YԸW=>K-dr/ ;C?rtUSʉ(r1~[yteU,Yқp?$4F.YEnN՛{EnE0f}tT89 L:-TH#]("x)ΙRz)r#{֢8z0zZn&W9=*UpDevvaW4w]zYILqK.1!+LGAEuDCم 9 >/8V34G\d?L vQ"T;݅{x8H2|&޾uR-9 PPd6p})˽SB!ò`l:D{W˘n]̿ou$Uw@Q,EeL'h%!erEVVȼgS$S@`x$c]?[JZF1{x.Dnt|ڴ`[ݚ8X k4'o cF+nY6:HC3;(!D(9D!~nykgTV4b9id&oK7^iB=э "m{I LaNjuSTXXX.|)ĉr2>e)3pK c͈feƓ6UV݆Dq8r |m;1<C٫a'ZXNjdžw'5,,YZ8z_*$Naag!x #d/U9 49> ryҴ7/P~hYjhĠ8UR˨Xկ(l0=|#YZ#D[3 !y })EMg BS.xW7Qn7r14]T$xP`qRf[NI|ӑs5@'75!r]ΘX_*J*x;Tg֒/#P›_1)1 UUtmr waX,¯jZ _`i$-޷wP Ϩˍ&F!-좟U_+]<JpO&p&ې[ok̆xbK"PMqdJ a O.ӿF++2 8cH48,'NK- ۫\t`6Hќ䷌්؃1j SI(60jY R AS:u%d_)$'MƋyjg]PیW_d2+u*Y\kƳb!Mj,b:NJ*>Q["h~\?|=މrZWFy(XF\5%o$e UHPm>MzBK ENhqUw^hϟektd{HlKe"uǰ& |jcC`LV&Z4%"LE)*SHЮ /3EB*jEdAX ^@2mb>,Cr_5#LDaa*CBDf,֗>}_) i91{CM98 3Hά8Lݽh?>e|SNG>}LE&gC6yi\'0-Gj = \fРG1IR+U1ShẸV\ &{,g dmFz1Ǿjiix9񍆥>á&4xLƖ.vBGJ0X}=F!/@Oaӣ >U^X^1pB*  p*xRL+rٻa 0 $Qm4덿\2p?=TՄKDz0ZqX RK4/Df:~DR }@ܢ8+ V^$ٞ9k.И'aڇdfpؕwLD|\z7wѴ" jq+)'ЄF;K"p'a)o"f&4 N8N6dƏB]^@3\D\f0zj|=:ZN(\hA9{7[ނџ?9-BEn§JK<;;=%Ld&E1xڨsb)1`ӘWH{B H37hPdAk!!'Ge7=(JH߸O,/"!A*gx  Cf"v(U©/fT^zǔ}l/:w9}şz P%%ʹLtgy.3p+PV!^&:q5brqN6WɄ:u3p8$I/C `nH\$[郚(z||,gR`a^Rq3O(=\ գlzDRH8URҜLѴ) kbsik0̤ۙC͚V )<Q+/ާ}gųÃ]ɏ)BSl`"LEDh8&yDqRgH`\n87TyK!7gV(+E07inwV։Qtbt4ڻ0rC9yMY/Yg >WH\xhLq%Yi`=,v x6 8N1ؙr{ hD>F-[%\k;D+xRB1BDh1x8v@\n½57U˴Kq%XuWC­#q$xLʹ];}'JVso|tؠFN0Vȏձ΀fD =?D !$0jh|1JY#wAi`|ac *m"pxȲDL;J8 "*ˠa੥,R!䈲>9%P y +4WZ8\ij:܊6R- gjW-ўdTQ`H{& 9Q|zv QH/$;@ރ l;r\O=LU5OhoDőDm/ ÷G PrԀT+ʉmakq {NX˄)vlc|F$E QҨ%ΣX@0QY/Zy?K Npd5g1UWzb8c/  bx;O!­o+>ӿ9SYl9ɤ%&A/3ߒ)VU@,}o#mGUZB;c!$P0$ s`$e6{1]TY 0C1_ 8&2z0KCW\mv3W;]*VUh,C:6љHbAa,FW4}(q$IԄG(ʋ{,JVDaRa9O\N#bP- l^e|eJdgOE(NX%WE=B%'P]H^ǰ{wck}==I)R#N#J'ȰS&(NɷpT>fcgǽq\CYI,̭ϥeD~gg|T.+]Lֺ&0F" VO1Šז]ЩXK1o?kc-_[qʺvq?:em KZja(S(剐qT[y+Rsi[\tN.ڧ\-W]wFWaݾl6v_Ou 4ټ!K>yeeE6R6<)A[<г d+2&g@k t ,(k+cHoGMªfd񲬴XI5LojytS0"!UJ_H9LBt"2A!8g?6. L MH:csLͪͭOF7Oq DFZmʳ2yD9!0[1>3}0::{z$i҉upae5M0uw^gGA*eDG6K^`ɪ@f^و w@QbÐ#~ѼEpp!O@l̀hmճm8;ꫫ)MW6U3!4٧.p5wX;A "[GE M>ɉ6&?iެy tq:֦R. y9A h[m{ݮpwwxȽ.\Q֣+Bz7]D֍[aEj'ilo>ȵnjLo|~3tO{S(bh|2:)U h0r0Rϳ$~o;"%<%ի\9ԡIw3s"!HV-J\r!pCdeXȋ[R?ǧc6$U[}J%-qU(6jR8m}kg>\O6ONOigL񈫬m̺B>̦?% $I)t~z~87nN3#^6YQ1 2W$ݢF$~Pi0q@JpNxfo/N©l2рyjtx=!x2#iWנ_[8x Og<>HSXe7<}?oAӝ|8(|hןۻwO{~ygE&j]u̢._v|q/ ލ߅_3uT^bCP8S+Z],7͹N! pfT4)篷ƸH #24'SxG9ڟ?_w.7'O;o[⸽S Zs/msϤ͗*9=>|=RLGtg_n_aGt{]_>vt +EvgSu#wBKȹi<96M? W}h|4H;C}ۍ&Zl5+<7ǻFcQQy[={c|V _L[{|樺?xl?>z\X,\s/ ]g}.41E|."a?ET^t@,{]sΏѱ7wlw:_XlwKd}Ozif~bs6bsۛ[?$Iȥ׹| ".>5~}zwtw=+t~}rDrER*W{rd#J/#0 ^ dhh4KmUCvf-}L`Bq}k{QYrKj`u?K W'" B.+jkȕ9ȃsQ' R q,gx$Nɥk|zhmq q|bT3)c$zou5Y/h$ ]3v|0*' W";ҒS-i+z!|3Z/d#1>G ѯ\l(gxonķO 9T8^f@5|@˅q<}F"9ŃbS,vbv>n?:㭱>}?tvMi[n"X)_~9~j?;{a..[]k*o}y.ud\ 7睽 C'D⃽۸;ܸ){Oa>Wެe_a8>(8ޕOHO< *B &U,2"SG&Tu\EX o:tp3lrӓJ 83Iȷe x~3)>+1]" >s{^ v|9NOY @HڮH9wf@cբ9Cl=AFL^73Rr&z)k|?3}+6xKϫha/oR ULѡNY9sg;tCR PaMffa ֭zT9 zd˧*SқZNƪ4MmXPoMl顑?VЍyl`$k+ΡoP -hҝ'JXBV0nls@p|~ĄLn@@%ǩ\L -qPSA`]F N[^Z_N猤f*rX|h+/g݁$%SĵelGg[Vcs$0c8gԶʌE9J?F\1:;&6Xoz<oBtʫ1Gx[AZ3W*)cHńW NRDKy|f iIʣzKIեdTB&һ0]_5p@(w: APF%1<9YGX=olA^ʔ_?ƴ\g&vrU2Q+R+DDSȳ"\NrgyRဿ:[r60x< 6׏%~Ųž)[HSDA0N9i7zH `8g`X|I!G4Ć(qfwt;PlMcbc-;τM,GmJeB6Bh`ibJ1DhЋ1j0VeQxZe(v5pW)"X5J˸3 15iW.G[ dC^T Ʉ9P.<ȲFQI[PP'b8Yz΄ڇbL8Ou,[*vy\fJ (H7lSO;D!m^u#}=_ӅQFui{Xd"ı{GMݢv7;t{JC, ʙiG/GRe9X-]ĬLYn.U: K7ΦesCϷBAS ؤzl-Gyˣl}cl%YAPY$ŽQH?n->O|ӂ=+W܀ hauS%ES/@DVOn1l2҇J%) ]̰o0y4wc]j"}HbN r) O$:Tk/%ldQs Cв<WyJS PU0_%g(S;)T xw?_eyXN e"|W68K GM%m.I_4͉b]k咋o=d>Yޖ/aH'}U#TǺw{o1vJ5W:E5]28JزƵҸjM,83}Ih+LY~~~S) UUUSᖇݾY,{_o+5`؟N0P%Or0e'>?lXFsiǏY" _XMFȬ^㥎YԿpC_1f9aqc[0A5Ckc5ɶHQN&іN6{0R+ܠgOק-=r ڹ# Jg lR%'9;Z9SxMa: g4(Gb Ll^6wWy^ckk! ]iSab@|A 2F˯=RC43+K)aP\iDs8KkqR%V~鐷B܆}jI'?Nb\Keٻ\_?Ĭ[ghs[h@n1'-*ׇ&{iUi N6~)h>AE(2sY߫6e~pUIU+zF3@3gKP٥)ʻ@̇=~:-YY w16:*w8V{."n.[ՓqlU>ʼn9tϫwߗ\ױ{)7<ύӝ-o-GO,^*NuYrGsr7x\(p{mowRb<7F~-~XK免}[5Vуwwqq}fNo~<.7F67{ uѸ\szA1a~50w6׏o7?oIs^}~<={<8Nfc2dcetn4EZr#VIŃ/{'ưj,^E4wFd[}=KhY0>88Z@G_~4{XsbrƽVw݋˳VG Q|tT&R{ !~(aޞk]|l떳{9xq7wu<κNm}6*`֩D r{gӸ؂_%0L*f"PI\& E>v7+ry?|v~ѽ<' wc=p98ܾ[8{-xnӝgm}b?zl{`{v0h_VnݮIz+I;*C-rdDrh}$W|:TՃK7PlZ#k .ξoh8n!hD -4ZVh?WH a/X\sEnYP'4Q/7%PA_-@.Bo8APDƬ&1 V`=UP;mO`C3ߠC)X *G+gc\*e=OQɸ[)尸luRR~hXm .ex\ ɗy]%eci.*ʕ䵒3u!St5u*/? obA.D L?sㇲqڽ9ZI^Ӷ, "dhrKFh (ͽ~((HKޮr@K ֐Rݕe 9RP +n0B݉!L+)M;7KL!ŔPdyB*z`?,J!K*_ tYJN:Nr19WA.*^g`q6vE~A=C=U+D̞y+Qh|NTB1eP50FZ0w(xZI0}aPxdiQw*IS' f3S96:3ccyθto(S).㘒| i!äe@@R~|51(1ŗQrD۱$1Pی߹w?=7DZf;*oqjg7MKHmGޓEkG'ij~c$$ib y %TAa*[/xEϬj|ʚg܈0b>B6[)E&sKDj<ǘ)eըz4pTV9~y=m^_[c&(h "Ok`nU@wmWcH,~t4LxosFa|ݔߏ˃y}UM(I9:1OJ*Oҭ?LzPAyNoЊK@KKbJ(dI)3RW~9St~_ms<AuD˦tc;io `cBjĦS!N4Փ7FeRW`b}^x1-#u<x &]iw!af'Y"?bTԷSJ}33p]4!u093SGߩh?6MUX7inT4^g EES#o1P ^O`iK/$2*qpbE zVu0 ;)^;Pۉנ3V|q{ǁ=/Or[äf~^pY}lys0 ,f^iFJ5XMӦ|/!+$X#cw#]EܵEZ)"®hiPFUnol,jL 5{P]mLSdv 6>)OC7JjB=[Rĝ;C5d:]i7qbyr?H!ny3LsVv.VC8L?h[ TBl?'QNJd{ybGiPL̿ M,qt]dA CHgͯvf"ߞNlK}՘ v0Nvu-^#Om11Zp%<\|boZd_Ƅ{":-yiTZZugS2= V߃n|PD=%P>n0Q>;ZZZGZ--bhsE3Zb\u̒~3HݙrpGfh  xS~IZyt&tJ^bWMfH2tL*#wxt,ƧL::8n~ \,{)ΧWǥ)p pXcxP"ƓC5bF r Á;&'(Sk}fln -(ᨛ,dAs~CNlI]{׎ys ԯ+VNU0+EPO*K!dM\i2E& OaFF-oR'iui닕Om[ C:<ߏUCEʢ'znJ=dd\u|VI{rUh|*O /O6_LEr(-Hݵ=6 roZc1ICvF̭I30%BH~0d}P-UD4xâ|F 2I9,?Čzn) mJgt:vK}Gۏȁa9x C~?ڱNN`9/B N/c[(##;ͩfޱ{P $]:I\+K5;G8L}^9dz:C̾q|`S)w4(` +sk `ޱ5oxjN@=qK[y ,8N;Le= 2 ?+?}h)=l՟s3yޟ"M\;~}.QoNàL+ /P xA@ [{8f]*ڐGK*W򾕆Nyr읟]9zu~c |q,CeZLZeRIDmJA‰6 /AqEbC,15guݞi*)kZLKYıt1 -jgԍx7V:c{ZR. f3 oځUCVzH:]_8C^/B×=rPe8M~L YL%[U(lۅ@85 Xڈ> Q_j0jAdw^,U?M15;.B6EvFYxJL8`qwVf1'FG܃9kw|G{ ؍e3φoWHY)hb$z4Wj!{UnO0fX""6hQ$Ѯ VGyYVA,'NliRY@)Vk ȊQ KDU@hVq}l[^W#nPX{~ifgڀjyijhҼ9p]J q眬*xwvQ< 8$Z!Z6+$Q3`RDL+L/Sk0⠆j)% @Bt=C=#O̥p[7^rf–FO*Wo99݃ ;u"u=V^ZE" Ui-4cUi ܷ+ |E23F $`,Ií"젼Sޣvo8{`8C0%yqU,=!FЛjt/7_ O@K|gWgOѾŕ!<T@l; ѷhL_rk]6E}Fsx=O-xrِYso䷘ IAh:҆2K9Gs*CZ,cG`*ܕɰYߖ)xt;P7I gbHY#WW~]GжRd !=+ y p4qp:i):zǴ@jsJ ~bC3gq!JCR"u1Vcl/.G*-r fZۈ?x_ݼst `Ե z$rbvuRNO7NwAN3:+tLO0&R) 1wC![ T34?k7-S_}-ec/`7jzKE9y٥UgG[X?*+PNe}R7-tIj"x]5مVQ<^e\BoPL)ATɹ|׬-Khʊ.N0-+?t̮Ɂ Qrze5%{`I2VSM7٭P@Ȭf6Za$xSj:f}( *ʎjGwJ/+^jR7"bQ6"bӌ8ZXW& j`b$ciB*#ihy^@uhMuX* #Ԑ7MEͭx ҩ߭!VV_e[z=.!C_RWAoG}&k0Ё+k 5` tݽ\dۓb\@2, C~xƣA;GYȗU+tV4ZЇZZxdkaG0+ Q}fN3@Ei K1?lxzauj,½);jl|p+uB bQ6/݉~ 29L6 6ІV;OX!!r߱i cjFU"*/“!Ɣj)NɄܺpJGmlzkg311(GX N3ON^-x? 8dOd5H wCDҰLda:z~u/4$~5)@YQ!:II~J5b ,GwX/`0j\_sӊѠ"%*\==I\UHf<7bWeD 콾 .hx#1*Ű6ll=qڮ/Sq軏%9]|d$ܻ$)lBC5i?)6PDvKKroJlajh"OS PЪj^Cͺ(RJ.=L[ʆ[H\z2F-ᨙ|i&usRR;8, Os_ 0k\[P˶ԄX&%->gfr7v䁐#'$35߃tĀfB)TL,t(fѨ6>S=J8nWV>*0 xb^+D <ܟ*(Ҋ_ZzG RF-WyӠļhqq R, V”0R\KYC_@4)DLb,},KVyFQ |꺰NNVF(^{nTj+R,UiumHѮ dF+b= 5)XT/K*/Q'SIm4MLC \^nWs\g:,R?*4ymS9ci1A!ZZCʑȅ@c*/=gׯo+.3<0FXnv\j!/oJDH9#.6.9\e직5; 3YAW?[xa]/|[suut,Rۥ_s&Ʀ_}1 sG;{M>9:0gQ 5j'vnv\'j]jlGC6)GTAXkOˑ5KQyZ4)SJ?ǤgNX g7ĚG\Qi$”II Rъ(M:V߬c@NFy̚˯0$D6A}=P%n]́jЀv ʫ7jvCSP)HG)~t7"/mnmX{Ǒ{!] Q<m |z!Pq<u m0ňq鶡dڸP³2"u2ͻMKܙ'( Nw6iM‰0ﶜ~⒝ IGY:@Rں&u?1=F%Բ(?!ҔH)\j1w8QQz7q^2f"J]huI3 ͤRPXCZ.:os{{KvRߵbO}[3^v|2B; t2R}RIC<tQwhDzۏZ ls구/8E/i tS+:P1HZ;RХjtBݚPbo5 txE]yl{boXTm -V'N9%'}w/(0JT_8% p C[xLcKŝT7N@/Ňݲ4)gDP__$,*@@/G %` qY]Њ]Ndoj[NL2&F9e[ ͺ !]| 2PDb:"TM'*E;͜+~7pY[%,Vp!RK,$O5!0?ԚB?x@$7"/>Q8 f(sZ4z&F*[fuFqO|['#J!cxw:G'2w}(JRjŬwWZl G dR?Lƀ֜#l 꽔3q3rM!S+(! \`vXa[16T› +sB~d+fD %^#.eIyZ41 "}|DWngQGlǞOJK k4z־/}(/&WgO_Ͼq[Ms IZ!*;WhyD9|f Χnܔn%8 A8$rkG߀I"_X;5l :ٜ5)"Fp؋m=XGC"g',l@gܩz- S.h _/j+ JCZzk{:B,WC(2 FMfo=ɺu͙v +5[6|ؙF`N7@~rfS'F' "n%Af3Jg/e䣊/ua$$F_94 4bMmY>`Mh>bD:i<dGY~6.#deӐa&6 JXj*ls 1Gg[[p6v{c&/6/xVeUI,@4aiwڴ<ņu7)mQyT%ƪ{)M0| ;̊!K`zMJp\pt"eTVb'aKPSQ~`ukr*uݐ`a5Hh-I-ۦ IA;5(`@s[ݧ2} Y4 m[Җ/y$R·O>Qw3U_y8i$kMKDѬ+8^s|$F9 59Xn۪dRޑuޡ$)bTsV(/cT(|ٮwn;ӗتb<9L"T_d#GZ𚪻B:ȓồetrɎlZ8D)?2M:J!II9-O$|)Ca 1/э!)즫Vx~ T:Do~7S9TNE&&+W۳+%6R"੒ix²ԝ3ҎtTo ~T,EsPOk_ϤFo7n'GŎ$WM5:!v" jQ|| /pQg<,kԿ{} µ}_#PdJTELJQ@{;O繏S{;t$(5 g8In((l{Gwd[s-}\nX8Riۼ4/.>,}<>:/{n7~ZV&1AMLNYCkbM ]\݃ "ǡI_Vڊ)"|`WjHVȤ|<Q-Xd?bVlԠHYa7NCahs$ yL‹EONE#jԅhLW_5g*ES^8FKosu*ޱ7ƈƜKwPe VFB #{9A/J{T͚,B;8z:N쌓LLewkk3"{%hwaEf-KM>{$+Bt1n]?\,xM-+,`>W [8?`n Xx"W݁9^f@]Dǣ&~KP#~lL)?}bI;VGq.s'FDu%:O T.FL@ HRf;/v$) _?g.ϬCŌ8NW:E9c1oq6%2r !6V 8%,?h|ΏӴēyN)'Z$h̰'ᢳ[0U<҇=d 4u6":C`Ic@gw+k%UI̅mh&\)IZԤ+n 0s=AHμ1Ikii1 QܹݮMwN uaND`(^z t)f?X;ΰ킀M7QEvƞ۽@50ziJ2iҢbHn+2&T * ݯlY?X ~/8#DОlӸc.cHVnMJ4)67c k2vw^hY#Q5Q1N~28f0["Vy4E%Rl}(RiEДW'W )3f8n[r=KD9 ?$DY^Cl=yM}@Onz}0Oyv&Ί2ziG)|3 0{O<8`9%yF]@{)jw Sy~~^Jӿ.YJL|\XolD۹}JҺk]NP=y4' .,,WRHyjKCMxe 9U&+l#r'ݐ)'[X`~ p U&Wk/s9=:ib wE ՜&֧qiɁ&+ PᎪͰT=>^ģ3r-y@z z"5!Ub~E'14|fx}2bН|ROnxt~4'3&399\{)#R xyBoG0O{@CwkҢl@+i$w"'c 'cEˊ_|9/ù{/~>8ɼխ޾w/}t}{{ ՀWU,XY:uS0,Or%)gD|:7cz)d.=O#NbǒTNx"(9hvH R6Q[^m?!kT H~$a@FI^8>!ʚS_T9;;ӊZ66ɰ6[y c95,&I41ouYKϝM,O3Q Ǚ(/Cၙ453T*]]y+U$զQ32F_(@%0s4a10K%.VW5&ךabK dj{j 4U?BaA:P 8|L<,p$~gh*{ 1Eډ^ ^<(/{:3C ɈԎzG*#5aY[),ɳLU<9j[g'R*r>q{ncv6.724u'[skē} Umk`҆;` @#wjb5$h,Aj3(-p,R`|M;F awl=u*Xv3|hv]Do &`D}]mxGGʾ$JBQ!i.'7Tak>?aVi&{O/fz5hE`k:Ϧ&L[x7}$D5BorP6ǩѭ%($xL}LH<>$ÌHf_kfN*/qwQy% cRe10 ۹w ϵƫ*RP,ksoũ,VхBǁ׺ 1&G ҆*w֩#x|AH>R8?ooF|Wi( )qui)t~zɨb1۾*ɣ*EKNA"ᄜs/ '-NLt7pHzQ1h9o ;Z~՘_JY;全H2dw1]uyS /*5/*}#ҽm& y~>俿A|ǷMhƥ g݋1SA5ˎ0bm&aﰑms,U0rp!*ڕ)'L!1.YN vg(_QpIg+[4a)diזd\TsbNr^?jx?/: @1eh)/F#kMs(X@uB(:VwٿI ^Ԥ[kn3\b-o*,.9NHI6-w`"lgvN2WER^ xN^Qkh_@8>ΦjaSk& te9TSPG 82bWSU y]qlgI6YՐLx{}t,I|SK |]sÐ]Jz?;#_0cbH p{b{۟fM(WBR?#+8S31uIW_uQeRJj&_;G +C /;qR)SiDvr%jbnV;R7* ]V3 φ(1pxod|iRz( eNE}T>XIRYez|XWli \A}T-u1t+`Ri"'H ̨$_qrvo؛{?o nG6Q L"Yyf 4bu u=E+͸yXRiOS=qԄT'!ڪNSXﴬvg{[RJO[{o"͒E҆ yvW~mС 5zb_@);XQH NixD>Dҁ3jU\ԸTTWM&n靑*`XO66Mnyo?j19eaFpG7`bB;[XʅqeCF )/}ch^l.%'/8mre@c`jA]Qhc<Nvie¨|3u a5Ej0D8eg󂰬?yê5x{Xcf}ԄRVӕnP܇B77Jr)TTz2/xk՘oe[EVPuC/Z{S\/W ؉A΁Z6' ufSNx!SǢɷ7CO HezU8O |26}HT m-ةF̥`nOTN/5qJV mm-ex]kRUDNsć[W6gUQ׌1GY>8ϲ,R EܽjwXs~s{XӽW²A9T!m1>y>IM oxB7<ӳN/0' ~lL|x -ѝrdGN8@^a!Ȍ)mDd5Hݲמ+KD&kU;dn7v ")Rs['m!N̘6lM&TVXمk{g6Sv>%ulŤ0OwQ`7H]wCv]g9 bWZmKQhuPh_L 4bz:7 Ȣ"vP~YA.մzW (stMH  V- *)+ } uP蹢ŃݽS*A#C3#-Aډ xj`9Oj|b"D >0s(gshscr~dn-چV"7^6ͨb BW4z=HRȀXf0FE1)0`c-/#S\.[ 5{cw*/79CNϡ͓ 8qoPM%qRR`jLJ7Mp#+}n@t^0_ѥ?jyp*Ed?VEx&`μI+Pyqu6OXW7iE!Jy-9 3o[zAgԨxzA3=±TcVb$v7'&W0Z8>|]J=ڃͦ!YRjeLƕԉ\ͻ}QjH ^p v4/6g` Dqs)]vA9) Iˊ  ٺu1g?ZoΌ 5>LJS_oDθֱ}9trZ c׸XM}ֱMˠuIV 34k}wf($d Ez ) _Sߞ_눍\65"&N'XHI4:ZI$G҅9'ڌ_5Uݫ}ljl^Z=BCu6Ũ9gpM ֎uzwF@kKfܞ|ΐ;8 ?cqsSӺaجu]"x(lۅNp2F  MK!KM1:@CV)|G萇 T.ļJm3S?ڝ :iA)$!yN*L8us!\׭#N&EƬg  bdB%^G~EJ!-F}{&#*poӹ/*ψn4J LrH*,2)C{ZnR]T; ڰ︓.w c@_3T:Y\=xFaa 9l6g2tnٌ_P…ّ;́ "EyPVU} 9HGt<9Pᔣg8jM׌L c¸OhӺh}#1f}<?u eSh;)d)ɴxTy>r%|r:6>F`nҧJ9r'lnP W'OHӐ=.o`+f·J`d0NCzܭ rWx6L٬YUToVQUb%*@I⌳XdBZ[{ExP5 |z𼶎}`@ڎ3R.{BǐOe€i0eTيNв1lMm<8?:bnYs$A}?Q# BkfBD9Hi)Eƴ]~igc/'Tu׽cb\56}"Sӽ[1PY2;2T8Κ52 27ww"O)G- *n(<=Aеɴ$C7z{)"%3Sn4ڥֽZPc׳2ߌ2јFXVIjL,ުuklƒ, آ{#!ǓHA|2 thG.ZW+A6H# n46vs$VzOBVy!JE/1No{C|34e5j۳dz} G6: *SnD/hz5eP";JG#Ds dֱcZ|ZJ<ݭ|EmưJڞŲl 0pHۋ7ggJ9y_Q -Eh .sٻg b/~{& i-&7x8C 9jCl2%KUɔ0ǂd5wϓ33M$:VUK|5Erghّwy7N\߂b?XD{h'֭2"_eYuZ16`wd]Ϙ=N;*fY04,[_MD?1Is߱=ZܑW<$ _b~:,4G9#ɅH4 Fְ;;@?;W[6kfWR+,j9 :K qz />ʓ'VUC[^g8h3Cio]%t'ZڶR28>85McX kk=؟\V" )w2A6L Ŕ׈k{ ks7gHDW1^B?ʿ@[K -g-vGG'/{o _c ,e^O嵣v~VoݠwMyWs:!Q!Tծ+A"<W 5洽ы*?6ydZ.Agbp\J) uR.3gMW߯E9E:t䕾T-w\hX&8TA>JiJ~V<Yqd0?VbcKgӈb$aY[j-e"zLx芊" t. vTfZ,o9?ݹ!jO2%@(^?h5-L2z&cg"cM+7Ea0׌+<#UP*- Һ6Ф_]_kSNJc7i:=f xz23QW4dړp=vq!u=* CIWYh۔&0=}LGCTd0#TE ?łpZN>m`\Vʛ|++*.ǨX | p胪eTE k&R$ [Va54\-@g8#驈J_H=d뎐L7J sx0]TR7Lt|2SA[}f36[/WRDMYi8%̺lD 1BQ؆R|[JQ&_EC}2l\~+ qVAȦT9d[(5F"|:y=k.a]fG5K6)! ^Li1+bJ.9[0>r4G9w@t̑-t&"?r994JF44h =&$&gz[\;dĹԷׂw$/28`̔0 CگKTpɢH̍ zOc>!ٍ, 0۲ e"5q.Bg"FtntT:H8BbW7 Eh7j{,\usZo1+%Z$  g֦1mI4=*9%A!`ľNҥɹERT:xSCinlP)#ިMhIv)8mi&$J8:p066n4"mLIѷ(&rBih>f6~ݍEELJ9KW?@&/MUJ2C(/RXUXXEE~VT˪V0|w,7#*ڥ rޯ`o,%B)N.s4I4,\#/]#{)2|@{팱c\2v?:-fK\TcNJYQr *j-@KlYdAո%ޘ!omߵ'ws SQ0Xɺj>w}X<{C]l[@1"~ܵʠGQ7BԛRh `H4ZG`8ctPKG$X8EOR\i^%E_w>ʿaZf%'diSPꧼنFUtsv:9^a=exOތtWzKLUZ\E&hm⤧L:2`h^zlW/|͐{5a-@A%l4gO32kBa5%Rj*1"P )޿(nvMRXϗ穔>Gw.`nm0djhSlB6C5j?ٔ**<OZ@,5L$?R+28"WvCcPQgz׭%bc+:W04]©ߥQsWe^Bwڏx%_nz'edL U5 MO D2y at>-{᥼d,]]/^c^gSkS 9GgjXr# <9yJf*o?l^}rR ‡ dޣ~j+uJo+IKJȏj1=TOg!nwW) %98)b9K+``W?y =$B!KtC@(S0|X]CkHʏ41E,S«Yx;bX0:F# cL#.%lnͿ+uDԘd(dZ* ^X{vyw^J_W$f㓾,"z;)hSVEW@i,BBabܿXGT  ;\`.7*Nk 2)JhR\(0bQf"$.|TMm>iaN^~MԫOTV$ B1BC9rm 'sBŸ0bh5).)G_UE8|ՋP WD*ARrfy&<]x C鶄L^F``[L4\AN)wQϏ1+j-L2c׉*2nSG>BtTIG燛I'Ex`)H!)!thd}CŴ`X//SȨ pi5t. .2C N@?˜# ~~C# +I.j6:]AX{ _01܎V>.k_jY(6q9=pG7*"rBn^5$=4C_EhƺMdY!EMNO+O3GDjDJT$@E)%2:iY01__Tbr#*SUv&Lq6t]/HHDDB;D+=M߁HnNH|1Y괁dpw% J"2LyM18@;BnFb"P]nȾ\~ ]ġ.(f: #e?ޜ>hܲɜm>u36b-`2 sSc CYVZjh_LZI;SV1M *{)Z.Y_;^J)5"QBA9ST ĜjS/Rj{#{OD ܚ=۸:?$lkPG9}jqZ>rMrQY̱4g*tZsTq󁶄mw` TЗ孼kR( 7>=>{-N"(Tupgis\RRȉUyN4I "7t"4UQ76I{\\/ e uF?F4FS' qdBkb.Y@oBY]ezi-\cF7^@fɦg:h8I eX!I]h7X 3Hlzf+;:/sC_̌9=e&pGO:&%{?ZJIPQL:hSAW$NP,ŵk*W4mb*m3?nJ *&z=Z .ܱ n;:9pvg'[}:8VpAkg)>}{N bJ!mf?JzzM;7]Kţe|l'IfSf]mPAFe!En&Dd,L%!{8Gf FzS\xJRwN؟iZ9͛p0?9bzIeҲ *"yt47AǭϨֹ'OuK7)ur~x,|7xd9J+ o K^*fWI4D!kRo9#c6lg@~xMuw"-:0L01ZNy~Vtv0&xk { Ƿ%dNJ&1N)ٙە.gI=d4n;7KP7yN0A+}myL٠mDq)uz}m;\*r1?߀3mmugA2.Y:ӼKӣaT9<:2} MKr+eJ|ˀWAbj wZjB>aiD'nLȱJ>E2n}s⑁ZXE̎^=]7&G?{5w|ź¯I[ {R:+tR NK,] Pt4ve^BQCec[gф^VU*3ONPtīYe>llm|N'3^ C,& i! $asUMh-0fH)GB'%2>㫢 ӱ32cbc )1olSS)* TvVbzB+aC$^x%Kȡ閷ytRk TBFWNm*qꮍ:&] j9xZsҰ1--ow?]I`%q܎o72"]gX߹5+ؾk-5&_9X. qłk(?1UvMUڑu[hLc! XO| w QS*'& /ػ8[Ja!>PuPk,JG$A#/):OQ[1wXaLmbYC~.T tEĖIh )(d!n+1{^O@=ii*ۡj9ApL#͚HKE_ ~U&Ue3M]*2Dq$Bae"\C;r\nVa,>.HCm'E@}+6kGEb>A0S2y2>24r[wnʤ%ǣ-=vf J%f8'@>کd26GRfI=y@Y1Eag=o`JMi  ˭L'Sj { {Hhwhno?6j[|`2`?3U~t鋟ISKTCV }y%ngi]b9_~$fK!ׇ/!gg.Yx6) d:OwrQjDIe9Z&bB} 4܏NXuc ɴMTbYdLm'Y1Z69 D&ISssut[!L\/|remJ/Ԍ"I\sypަc c/2 :7zye tJ:9m%][`3 ;eؐS65ty:J0Q^:MhO߻pw1Jw_6ݶmD9`{F\-785q;?YD覱Õ)Uu-%FgB;|L 2@YoLeôXjk kR/2t\+XAW[VDmcw.˴[SM*N4jR.kG5ٮ6^(dժ“[M'53]N9peŽum# 0i)EFBИ:JJ<]5^ZZRy}OPH(Ka=;W:QH%Jkku҅4t 뛭JmOp Ϭ{,jNKYx4+GZoGz\]6{{pκGQ $ynӟ2O5QXl7,/iUQ=s?ձN =P5YiAO}I,)[]D q06OW jK*;5Q#7|8~'A0d%͇_ʜ:n rO">!a1@S.-`όçNJH2 ӝc5I?OkU }G(+ĠvX8霗/N/.N/>]l|{|^|n;r߽ {J] G_L|&vn5)tS)iWf(􊼴2 )%٧EF{_&NHBjC G?-5+_5|5m(r>) Ht.=^[a~glu UUx)WE.fs6K(gޢ$Lc B(Tbp]XZ1?Ht]ԎWs`g4+0Rԓ~I]_8z#s|GV)z :?oL{+y:&b%rT5'"0S(bMP2[!R-wr:&ʴ k*؄ԧ~o|8k?z>іښڻ/{7n'Hc.[3MrLcY X 9 P[XF'0Uz2!bm(A5k5 :¼ =wTt1̠shyFy@Y3ԄaƋlPFLn>)KGː%n3^0lFiہ7sc  $wrOuBӥehL( A1H1;UJ8.?8z\=bߨO~!l %MXwL9{f nÁ*j^Y’R)T |֞:$S;;Vꋈc5^e)9w&wg=+_(1-x7a쮔B5|gyNbMX/Ĵnd'$[k؋%P޳6'0FP0(X k!; V&>.a+BB#K'Y RRL~ y<Ů.K|Es"aOM`fؽ M5Ioa ڝ īI|͂bbzϗق'{;?5@FIbXRb+KdV XtUb&h*?*ħ8 S{-=y[h{eǕ yIᄫ6nлʇ#Cz1*Z`[67q.Xر:c !>aw$׳; _d|Bw@EL쩪^|ILXh…XfNlqeE ?˓}ycd{!-gn{M|̾z^q=0O7đ]U+Y`OX`fIsZHVOP'w=)MXKLxԬeʯ5nG*,&Uv|?xަ[lt a&3?ɯ[lafiUk"ڐk(2ПxǷPs~e򵣯gU`ࢲ)dѰk'5(Z`bS- rI6bq2LdX!EOu" {zسl` mq>,:7g gdP7H3fƠHqwNjbl׽>9:+FOy4QcMb6|sbnd̍lt]{n˧+р&+ Z?Y={R %>|]}Moq}<_0MNa62$dVc{h46QznߣOO?/,2I2.6.=d-;s 鉥o&G|NFU4t_`dgH2WCлsՈv04U5r ugpzS=(52 3z0=*n;4M!*!SNzp GFpz8llg{{'秅ӳث̛JBpMy1:{*YKھ)rQO\)Z`NS(]% 9Y N[zx͈r=br#=!7  :^6d d)7Gg_xNQ 6jg \]| o]ɧN>% ,PkzjjnjW?2ع<Aw D Kc@<wS~vvwOHI;?ٯ %SRQR|6cT0"*5ХzDˮk}Z*Q .4'[o,QuSۘ[' {~ncv$N 2y<Ŷ>/+N%O"7ACS V7\IN";-; Jd٢ ^ s!bq/Q2sΓ>t!a/k:Uxg2C+CGr2>^ZovK8E* 3'q؁OR2}6ts<VuV:3}9)9jF7EY%䃖Qblm `b;ЛJeZiUƤ$u{jȸG*>&b)շ~ܥP0sIUuƀ<@ݦB,9VȢOWM l 9VȪfT :khSlMxԵ埱 .fF-`ｖ#qYpKd}avɬ,U#[JjwV@o-"Ulk AZV&;r L eQ̑/[C7DpoSeC&-Va'ᯤt|+r\dy+I`x=ˎDz$` B\i$`I,f&ыw"+F#h A \6xt*#E^q9 SD^,"L\j NkA6[~o:I"0 !:ccW’7LNj eK~+:ʟk:p_Hƾ(`崨O!rd }tNrriѡ8;;[??ۊ>8 Nd> -CgY:CI99&CȉZpꎆGCG9)FSI1%Kޫ_ BW"ԉI_"Bt+R& ms{u{zJ_q'4̤h_抡9% ΰyMi/:#`Ҵ]wDt Nҽc2R6:c$; lvx~WZHXEwB[ s|"y6  OV6O6io[ D/_9ơ}n;E2CŢDZ˘D]Y(3LHbG7| ' Թf$Z;'|uߩ$Pi'²fjR_ N†iqRq#?Tp,vt1<${< ~@7`H!&Mp>BfGo5 w_^h;m/KL q c\6loهT>W c0F,AiDpsw?c$?nL-LKȴmU eES߄&&G :ft9|ղ^4? WԥHHxH7;q hQQx,ZВ$%\ªD ';?aHqKMp]p(芥# _^翳p\9r lؗ Ӣ{cWc}]1Y1dHeY~ v`$h]ʪ ՐIgls;9àf+C\M;(Ka.0[R 8E<6JS:cUґP3td㟣 srjliDc'T4e%5W{:vGexOy =Dawֺ'O‡ lK{PD= X4U82r>8Jô DfR_DC. P ,=5|B& Qj/"ƙǣWlYj>wPS1Z--MNreqܱ1dl_)cui`ߑuO[' HGmt e;Dr;j=Eqy s;%oF!O }2Ƿސ-g7ҳoVmx0iW'z~699v`}$U#Asjpy8th}o-`b ձ |̒;94$?l!Bf|_"$N,*ga!Yl1,ѱG+v\Y)8:$v~/,*XZa͍b^y"ťX.n\*v9oP›- >ˑΚ*.&;`NI0U2VW PLh*~ȕAd=ԩZMr&LJd>m\\TH4Un5hV4^ֽթ%mc!?hrԵ"r,8h ߛ}=7>IK;7O|ne#U31cL/7Y~Gn]ӔG\*Fy$o90΍v۔t%i7iS\MFDҕcC$=S>˜Y"O-xr2O>P/bK70zԌ6n>e=".%Ž< tFlMQfg'/W_ N/U5Ú)j8ugg_Z}u _K%r)0R?آ ۬a}fJ^ 8??:>>/T%TsB;Ud Z%_m*νr422u&՚ Ռ-\|rgFw>-t<WZ|x<iFnQU{v~T)k(0Y&ت{uzJZ6Ɯ&p`N?nmP^w6Z#~L7odDwz WXt@b=T,qrC6X5Wҝߪ_M% r IOcQE)lE9*'| IF)OK~AeX)08ķH^khdTO5Z-) QIR"R "x): 1}(EzᆜT V`o_1#UKa2x/ĵ&d[D"N.D;tDJrvI~s"ޠ5k 1tcQOSgJƔ c "$hyC-ʑgnHcMEhenxAڑN'-GS7`3]/3s%eH~2+C"|/I\E\%HN.VNz55 \q>:;?9<;inæ AX0 ϖ &[z:6jx*Px9&3hHk}0|%uωdyz|61#9] w+ASא8ut7 q8Æ?tZk'! ɱYտizC V#NU6:_qf6lၴ݂5jvmA(Qo<`ɨ Jhcw4ŶɁ2YZٰ|YO&4il!Չ}CϷ-4w^.oJ*VDi6_l>1v?6Kdį`/zo&0Ý!@ýc4"m۷al><.+ /'Ff uZ`>V;}"}#zvo"E'BO jֹ$Ŵ`1.2o 3%+}l:%gOiD|"砋2<%$|kYֱ*K;X ?@%"37Ǜn㦱u4nG*-`b$H_ ?fbt߾֯$\c}(DlY t\+νLfb&=Kɋ<g^uP$?u"Ss/hR=-7խ+ |oH6]I i(ۤB1>1ßJr3W:l2췆u^CIʒpWeLeb 1UW"".[X:)Z9iNխLP~0zZQ1$?h|,xj!K6͇1#ɲ Q5REs d}W*P!c 7:u X!8ObF|Blj!h9 GR r` !7?z&ϊ9N!)+J*{TY:d?C;FP1r[5T0 i$PgN NcwJ#e9/CTT4T@104/[1cg@˘>%&7]w'UurttJSUv]j T˜,iI8]r+8C9fZ'{30h_)XmhNFOJuF'"")pk~3 ӱ(T=dœןUR r)ZΎzm)QH-敚4O52ϚZQ|:·wŲ}Y~>̓sH7{O_/+ۜK:7'mom`ka)Vt0$e%3Gv R,sFpUKK.L(]QTPWuZD+ B֐)䚘WgH 6+UO$1d/2prLj<;kf9akݿiwcuO0Os&Ņ |xfd*szaтclh$qNNGOhQSDNȍ1jzv<4wcY֍%g ,HˎOΏߕ~d^: >tܖCZOb8O8-ď%S*P&rB]$XUK|"z}pk:>BY7l:1!-eC#fhϖ"+Ё.L_"Y~]$t:-q6&6#kNrdeuҦIYF1fo+%?Ez"Q{#=BađɜA2 *άӿ S߹6G$pp,.l>ben;_b o+W/zsˑ.h \R!77[R-%\K[7+Jb+qBNTwO6g,Bcdeѧ*܎OTT෈%M1<4hz~Iuzmo{s;GbS8$u%Gt2L-!]C~ yW&ւ^ V%X88z߽hx߻ dv ]%;ɘn{q(Yu<7x.ߑ 6";_NtmH:j^[-AiVashQ zh߻-AIߞ}ygN0v:61D\^H\)g8')=]Z;:+#f}Rר}fH1+@qwm2ް8ᯧGG#51JA5,o5Yï7v)Of-G* K ٻ +WWy9V,Gkh)hMѽ?Z R@ rȩCYi&M@"c qQu􊫤OӢt!m\yw ˆ3%p((ڽ~3";.x[-א[ߘ-{ oĹPvKz>>BDA&w.?0>bʅ&\׽ oPm"%=Pg0Qtk"fs̸89:@~Ƨ_C,fin (@}?ڝ4Pc GK#2illlYÝRwBwϒL>LR" ejgz W$)5զa:`s0| ^V(Ӧ4˵!}|lf ]"Bξbpk#;aHSz8O7RI3Г,*WQ%r g_~؞~8WD/ zs%SӪ4 A7 E_|l'#TB ;u.&0nxz.IBe;;<;z~׈B}]KbdOyOmPi;G3W%0moLE#If; /Xa(OTWn:bjkX)2# &Q׺:_b#o)%W~Y#u$u_d e=O2P25\L2^g-WpP$YS} (̓;L\*a5ܹꘝ`^UZ<{%No #J3t >HyxzI:1kT d^˨)_ԯ;}u%S.ތ0{I8_ Ć~rC!~ͳ={(\(FLP7B,Wk%AJ@,X CYhJZPN89?YեjQ_)N!Yу?(˼>5ňޣ eVkQa=s Fa,]%ƙ"ݪS^-KKҺ)s*3~r(z 6a1bWo}311j.cyLatȾqVd׎L%MҒxM.0|6]82MB#-%}mG՛ZMt= f|G7*~T up0>^N)7ѐ]oDLmמ+9ݐۏ>] pkܰNvr^J.7ҷ>c\ cX=rMP8hF!5׬!c,9@Ov[w#ErAVeNeuҖ"lAf㇮űjD4d +R<pk5´kj9V)B,ܩ"UoMKKÑ\TB([0 2 |r7l};e'ٓ]lX)B,YqmՅwJN+M~t+i֚@iVW+GEtfH^KDD+ѕһ-tv76;OŜY$c,CImpOo"R+qC/gjǏI˔`$q~ɰ7t|'Ze\][uBB:1NQEOޅ yVw@NaWVO%W +Gb<(ߑ?)hҦ2N@_챶wcyݶU^5BF?1(᛹*1൚R;ME )T@G*DsL|9vhQtYU) !YqHӣG]JM_ n _ ;c )Y$<ՑrnT 4tDn;"ke^pG Qw}/OwR7lca>?T`˼6*v)80KSNց~.qSb; OWl_j+ıۉwq)P+ CtzkI&q"ؑV}t'wQ\X8* ?qQM\/ؖU4cbH f1E6^P{܄$,1)Jiз[Soo=: ҵ<(rAFkiLH[A*p hϊf7蘦]mnWbnXHyLUi_5ӣQ8-տ3?-YJut*]u fh}4)ǒSX/Ѵ[wcXHqZAg,3v>RҘ%vn,s軷ėZ}u!OР5 1'#g^}P]39x "{vysۏ9 'j_"]e.B)szAVJVLyр`AU%=>;`NP,,|Sޤ>Ac $y9B] TBnx.KNF+0|g+Ѽ~IkC` Ԋgа(Ϫxɖ8F]]K^#Ա{V[Vb|B^h({䲉,7R,-)>C cK(YojA**\yW&'>y#d=[DiKnJZ(K践 +Tn`1 %3!H4A$Q8+gfIlݳ[n"' o-ZWCEظ yl<35 w=5MN 1JDPC#'C7V ܖ5ElŌJU|G+_c+* $TgP꽛P1D Qe8M;|4/e.e+#xKT *^н;qwzL/, ƌr6REEH=9nFsa:)jp9Er`K=n݁ 0kЍOyHL\~Rj|5~Q%G !ܳk])5X]AwW%;}f$E`e- VЕK[Rx㆏4 Likjsƥr G"DWDEw_Kr38"9| 8 YKȽz?*%g!36;j~݄TCCUJ_6|t)ẍGT̫2;eI& FSGyZ*ѧTv3$;2 g7dk :(?oO+~c԰ 0`yqb%1R( '߅J;j {؁syx|m Q6%m`ٳߏI$,(D; ,MMB9-in2_'u؟΋\=ƉIb|4KO_gIϋ)iIc'U7ɿA*IQ_lX DLD7AG0y͵=&~) @kʝOC} ':MĤ k|~8ƽ,M/ur<c*٭:)`IU!NDtMk,F9;`|ԫ(4];mTljLAB&׀2ok_Y%<)@}>@bZQ]=9DŽ{-9VQZxɆ4]Iqets!a8Z@_Ub"-<,&4ëz,1%311Tq|"-Sш5 vR *~ *kɝiSgFBZEbyxOg Njիַ:4PB<0GA*1YQ dp& f#" ҷgHN[tf ۹x}fYnhPLk?- ( But۪?%8iH$iF0ΠۥmKZ#G6?'Q`Qshd_`L̒Θ05?f`'46=A08qҬڂw Dn.CSw۰ɟt53?"iub 7=ؚ YЊ]Si^fؘx6z W )^Y G]a95}}S-+0 hkzϞ B|~L݄Hh[Λ])p#,MSMY̩cg gsOmx3ά^$ QBQ&_4ihĝ&ULxxsP!̴->Cg|@觙J@>ie&ϦwM ܠ۴}tƲkITn_!> G!>sGTP(ļOT FL9B⋁=фu@|$wutRg WsDp @^̷}GNpA67o})PWc&gf6;̄k3 7]KA@4%ݩTx6}3 7  xbqfh`Y"F={@ȶ.30S1zN92T>~~|}z߷'ʒOOk '=L3Uxx'kq6;ШgϴcFcR$ p)(ަ:=@0 ӇuU _0l9! M+ 1 HOM.¡y{wj<0(/!/OXCP>7ܗ/rt5ğSnLm&Wb vF!e^^`mjR6ζjOmkVW4=^\"p[˸G؆&@ڽT\7Hs?5CK5.7djP 3C>s"1̡N )>(1p\]6};Lfm6>,KG'D ~L btP0X)BaQ< %􅠓-8SFlòX&-fq܍mRp8<;ڄgu% Imϲ [z1 ^<: 6lQg}URM"Å{~X6]ǘBOߔٟ\lGynoBNhg/OKzzvƣ9 995; ET۝W1Fg[ ?54D\W u(UET_)?`ڳ| db*N)M7fM`X<;=Ͱ E5˔FSGbrZ/;c{PY^Ee0`0  8KEOGY1w20:2 _q:zxUo:,:;FܥBv@9E9$[p Y@?nꚄu$>͙BwǠ0! Zf&ni]=ӆ]tL[XG;8Bhk4Fw46Xtzke ԥ0΁ KPf{6>g'N!lS5^ppVٞu`B%0) l~?Y<{!rGݢɸ0{{FR?Ѣ>|T-J-HDGM n7g(Ӕkz\%y}]Bus]4dEg Zw'z+`ksC3\JME\ {'$fv +g&xfF2/Q6U@ĵ`"ǟٴ->na47.cu>w/ysJ9$^`@arL%E5ôY5/f ēYk hjUmKi8|]4Ph4'9lCH?:ie 8g𑰳P?Tcx:f %=4MfʥF 0fxi܇~-`bП ϯ ʶmHtablYpY?$Kg2lϺ)EN;zu0ZpIHzb6d afNz|V}[-$wbS^ȷgFi\lXـ{A&$3dkb F$8FAo' Ȃ'Ǵ-g5"m`#w-" 4mx"6KУ~  _!핌qHm׮87`?.s苶A 'WڿIXĉKB^ʂq2vot&pNG3ۧRO\Q}ܥ {8 :4K>OП!xQ֚Lc^5Hel ESwa"RHH4Pd6 Wژs:i_{jHk=7ၘ]!&MtvX:9i<'<,qH\_Ý?1ܠx5K \K,6tQi4+Џ~OINqnqIjgJ"``}~;,"5tB0cJ j==Cu: #7v'&S6jj, HGDw)t{@@ucHI8f,0Eg,?Ƞ `yO:N PͬDQKqg#15<['p/^s IT%v^Hu P R^MKGK>g{LrfbvBpt #}l`%fHCɔ=4Ps9\޴A6g)'3:4(h$Z*h ,z.N K ofA-aq+p(L]7='oْMS6MB-/Nj+ǧ CNUD"}d}~AY)=@uV}πlngzY{7d˴q>~Jе.E~Y>K:տE8 uq[HS ̜/`v}䌑lMShKxHi  43o=I]n _@ϝOw2{"mHL!4fCofSΎģ1k*&s" %Е$nXej;%~Q؊IqZj7sD _۞Iqzzށl5u$yvE4L4ɂg8^DfJ¢~2IښB=)/+b+EzGcic72: ]PmѣQ1Y$} tCe]qKhcC|0a]c 2zNP?Y[35ѸfenR|q&,np Xf= loMjMju۫|JZ0g=!`U' l/w|!g$C8x~^2 6ddQl=; )pXQs4״6ł=XWXؿ IX`YNPڜ F1I1G>;LM@v,ΐy[:Ah/pdthd|a[wc&*k+pL&iܣt<7>*∡Bݴ/bg2;ȶW)d*D,x]Og/_L9=h -S/rN"u>E,st&d Q+ ;W/U.sϹ,JkGA ,WUҳ$ 2Mna =ǴC *BST]}Y䎳=e^e-G`z71=9M$R8KF jwlQM[9ڸvFw?K/;Q" ~oN՚鞞GBF?Oy(ϛH rzVzMiAoll].'b޽gt7Detg8^di+sd"Õ) N_Ӝ̒p fo="d7f` WG]Q_Yeg#3P >zP oIoor^M4NNG;qє k4hT@X#vPC1_t4Fie*|6oV|?Pfqc4ύ%=jc\5!ONNn(h(xUt+o2a{+kYU҅S¢؈Ndgߧr{6-\ ZzիTuG .Ϋ:Nh'amÌ4A2cPC2cx2M1φ(LJh  ^CAtce͚$L6C`W +YU|zhn&zҘ|1`gIwྦྷ #0٧0|ԇ1*؎| Ana<<&k q^a)Yqmv_3B:(l'T6`%:/hm\|8P֨n9eku_ !7Lʁ&=cIք5Ʒ/Jњ㵡6 Cпpp9wo N8q(Bǘ¥hH@76rIivm̕Wrp洅uhR"!Уs d "\"qI; -׫kH$<#)ݮJ`gX9v'q7nVO:V ڈ;lt"ls0Y &)u59z0}WэezFC71cNşuX9:=*уja(½G!eqޯ߯X 'f yRÅ\0tQ!&p7C]?j]KbinzSlPVgcAN v5G5xژu7-k5&Gxu!A;;n?gusFӽuvَCB~%51zL].<.ˇIi} ˏ"N¶rW-*C3M@"&l)F66<# ch:*zkD\)Lz<@.+|!$ b\W >u&~$@剤B@(}$&֓OkDpBח[GI_ 䗐,:}tkCPOߣ?_tLYeoXDp?_2:iSH́*a6< gt%cmԝfadiykh m| FB [Ȫ9hH4SOPmj僙g<*W<ɞ8 ~P9xRkX<<گk3%^_q|6m6<Ϫ:?Tk٪j" ؐ4eSvCqk]xwp!|Lb/ݔY3`/ FpºH,6yfxUHnlV쉨 U.wX*ޖ.zΎRyzvx)[ D!OwBP- yb v:fZ@/F%٧# ylWQ(d}ɣGC`uOY%tJQ<]yQT@Vm`džY_XM ^ScW7~@ &)(9PBJK(97nXy-ﱅjEX)q[.3Ԣn>EOECѵ)fw~ rcD9~KtWPo-AKzتc_ۀOH7mQZ$SRܝW&rVmac_6n :hF]gqٮh3v!+ @B=~ IÎ /}XsIL +  G,MUUg6 YW rt0>C5 e; $+5 ''>OQ9+z֜z^KؓlsKp3  n' 0={fgGʹYgs mB^U 8u>#'G|Tg  +s׋B"SLe R. .~ڄLzt-] b{˗8>5`.67Z#hp)v{9_2VPJ?<)AIA^#g^(y 3o9^~ɵ2C>nNj&@6/3UUCvm@nwiI'b0?SO{ ;P]tFbcG0s| s4oTīTl҂s/|FԵF Hͯ9NJ~5yy=ڮs:IsM |MSM6dN3j.'d !#EIDeM~ amn3>p:oe=6*{R };)ꞔ,q6\N=bC G3Rc(^1CQ(ڲҺM=Z5~'Ʉ<!wU7;  H}Ԗ[?4y"Po=ד"wq~V*ڎ6ܣ 7:(SZeܽF́u e W@0N PB,h  1«n-2+޷b'fS.!S oJQpL0ܸ@%pjeAD,tu%9ww|8OFnmKX6=o￳AZk~vq9/^ D]ذQ1l.T"8ռ]KWWsQ5Th|ñ @o#q)Kgr/N|fQЁ&a~bʹh:NMu{VYfڶ\@czʿ8ޛ=;;-U6,P~i*&R6q6{DD/xʄU=RS!UiC3F6 B@UM+\=HT[nPwA&8\ͯm䔨"Ng}[g#o$ih<"pGŠ^,|U[h;p}ħPN.$vS7[mMQզ˴ }Mq[l3}[V&!p0Vb34̀Ʊ >Β2!Q2m˧&e4 hN-Û(35eBЃl/8mj*Ix+qk/KbQ[~ W;5 ;3z[,g{]N->P"U-{:؀ARHDY{c \!QF jf8y&_)R K9itSk7M2|DUl~zD;or*[IYM4\nMy7%? [NmUe-z v 58N$ GacwYCnjy&kb8@tchʣhDGlrrdI\ Iz *_e /TmzF>_$ufkL}b̈?""Ԙs_AϑHKXD핳JvZBε 5۷U5V7M6]B-1mׅ’?-,<`0yo&3hFg1vQ b^zLDH?X?PXٕjk A,PPխE u\b2ۮ܃p9Ki] FS|e79cT9#Tep`(w3t/,?R̋ũ&fBj@8/V,_͋q*'{(=_Q| W}Ur䘇hɎFUŊHk7fߨj=<#|\]&%52CB$$}q G7\&'-`6?lQ_KZ"p3)s8ۀwUK55E^F l;4\k[VلV6 %{-lq3FA`(/5>s;B1'֍Q' vz3::'ڼZBx0;֦U1/KjS<2k>kmhu ؅4 r$]:$#B8Нaق᚝MS <p^c}5Š:ײSK]DL9+ 5璉hIj=3.H`*áe5L\?)q_O.w\u9^m㰵'bv^RBPU]KU07=pY?$0ހ{ /*v%݅3:2Ur ]ȕdӵ@UZ:?)Xx*̦2X>֗,P,0n {J|XoCX%u*j l n$St eG($=Oi-e,^(?u_[|ї3 d[ D(n >cC@κ4R|ϑM\ zAlWgN ãJS<4EJy*S񅮮PN/Ϙ~k > X1:js ^+9`6`(췗j"iEFSFU4E {q9p׻\o}+U5,NgێJVդP-5h֯wn8^$b;Otzh^0_J3, E6Ө"ڿjF4rL.RK<<xX{IRI*ôW8P$ZAx[On C=ٖJX<=OWa' 0zC=iIxxuDpՁ7\ozJ/Cy^mX֚)Srln6 _g bujSo1Qj#~GVX.3Ʌj=ʤL@N'ckT]}Wh-Ā @}OןnQ}Z5.'jW6E4Y!:D$YVJ7x}Ea8ؑDc}-x6"7 ?!оM̕iPHe0`~c#ڶvf"77N=6rE nò Q!=0wa/KfR E ]_DQm #nWpR]7Su’;r\>+m8iFʡ͖}gݵnit9.T# p{7˝|:պ{pTVLXN$p/:PsYryrT`v>FQ wAPVL]#lރg^q n਄<d Ea*}x9~:zIDs[{Do$z:h75$;X+1Vm?vYR]N] ljPza/3])%5TAw@p?E4]$9@(6تY6& UZ`OFni1 sф@Mr)d,]76vnQb~l - ! iKU4wPS>aٍMNr䄣F?衐E rZ##>Tɱ#2k#V7heϰc.p#9V ~QvLhF7HG2~7ޕ".Y !M3Ϥ8$?R5=%&ILP7*~iTȑ?heԐіO "?d^*$dRD?odL *ОO$9lN1æE69Bn ,wL>ҙe*&/LVXqE3>J.EHDSN8YeӜ6%iE6~,`YѱOY_qg.k%"bMZ6~.I6é,)M&*q,O;bt!l\ EyPM\_$t]=p_Q W":dY^F+8di41m+x/#xsRs w #:2$|2 ɄH)>׸d2,=x3e>SL ޔޔD/e:.NdЍ(`t? sZxuu02GuGsX3dh1&`0~=W1N }pW*E ]:+f+ 57'4޲AHb; ,8wbj׎\[ҌST"dr6M 40aUC7nX~SnNlvOVC@S@=~?'oFIȢ@ND& a}5ˡkb0qGV0J-W8ncڝ6WA$£6Qt]'1xT7̲c_alUW Tf/P5ה7zx.\>~&jzI)F/-$\Jq9=$ ,z"eMw&%ndb'Ϥ,r-qRN8EnN#Z,nd>)HDBmM!^c?sqfהg%@b-1EBIAuFxbs&'Czpr2S %< eR8. A%. GnkGir:LkcX Q7Sp\V0~l.x3x!Z-ݔDvOy$'''JIe R?i;)oIO YاvNĄx&btL?ߚM{hx{9[ x,߸}D6QwVX(=[[i_u8tļ^׷sS@ b8yakw+D{dϜF;Lsh~wR[+~哳%AD_og'Ii!NHy1LM6UoVtU Qmlv+F# =um `~abLY؏ȋLަIA[m]r)݉=u۹JWJO:ؿ>W # RiBKy}p(Qڲ5EeaV1]tuReMԉ󵗝CBϼ-R ڧXN ƷfCq, qUG ;&DC]`1X 8X<0ACu:,_/,Z6MՖ( 1-dL/2A;Ѭ<X wwzV>RVwS.l5bX F4zdxs!$tzUr17WU7֭)W=e/rXiǻ>o) qWKZTɭ(]άAwf)vϚIW"WR: UUu#C 0+8s9}]ktwIh9\YUv4rq;bC048Y \$f4_,[C4 ^"yíRjݚ=7FR̮GD&RP㶡[qMҩsǢkapRs+3~%uhMma`}zyk,1ƿf'@߄Ԇ&aaɑ9hWwŽEsЖ7liYxU8A2TISFsk:߻snW*}-sWQ$ =|y6Lҩ\6h6Xb x"~h(C̋yW֐_NR!qC%@ UJ7\kC;CMp%=Ǝ2 _ZzD4.'dƟO5YjpsDPlۆW%#FM$* ;T]j (v-#/bC>@<}x$U+wF KB EIS @c8D85/O-W]ݔ;½3൬65PwpCtWqZzk6 tv@(+ ro=אJ:_MTXĞ9,fSVh< J #4nC+-q}$@鐊T45r`Ht,uap9X©у:;-5p5tB|W&j2RZC;ź>"0!Şډ؂v!jB7Cj[x<{Lpv]Yjoۼ "zx:B +b|UZ쉟SBR U,Udz?ݖ/OEg>+ƆÞDalMi:;,l4Ս,7#h9B ҡ>+a0!Q 7I(gHhbDin!7vsh(%"!,'clx;!3oPt* Pe!狌@q{:cWcu%ܭ{@i49i#C vOg:K@E|߀Ybo*҃HQAi '=lUIV-lhDF;W]^^IWwgmϪǠ9uvfoto5C< /5Ivnͅ)G9#%$x`ʁ`w{Rs,tvUҼ , A,>-<{lW*hrp:FHT3l<+K 0q2,%]BACL6JC힔wCm7~$<^hK ^ͺ>,UB0aCqg49 LhcDum;Doj3*{LqԾk,^*! $\MIMtQ.1,;;s^rcӬ-Gu`^1.oh4fvk{z{Ge BH<'5|Y=}q-6 l3q %ZscabY !/ -vТKix&i924<54lR@@c>{In NGr8_ zrmRc=,5 *%LMMI[k *@#ڴUֱ. -dCnn $JSEbL4O(M^绱a 9P暵Xω̩'TSZ[9m۠O&D"轊ꊚٱ3"DծEE{)خ.i#e_ /g]y-'aѮʖwCB;FnӓBjWfqTl|MUb\΋4ݔ+k \4ճS8LeըjY[¢=L`-baZ:=k 93?`VU˓:WPUh9fxܞ: UƶoO^U錸YYҾ)y  o&/L^wv^Esi(jwuq;妤EayfU s:KNQ?TgG 9 !5mn "u߫"BGϮ~& d58cZ]zi ʖ^=5 * *!pmQ'//AyJ:(GkXhYlotHm뚣XӔ{NPg*S VCUѠ?}tcbxe:nCUt/o๼O~:00: LI]kPeHm.H$PS5OhP"ȶfK'd"La~u_PNj G%Rkz.ovծ'pF;b5E>F%\p\|`1.Vk@IiF3ŝ3mQq>J'9+둰thI̿R O@J6':|N}:@1>is ]KT@"x/}@Ɣb]?,hK+rTQs|yc#S盼kJ/@9{CۚSl)"FP:mC݅R 7 gekh46Mwy0xb<{ZfvYob8S`*Ft@x|=OdމhJ1XV~`f${`nFLkwyY+pC4{`n@aӆ ޤNOJ0IR pڦF;: U뢤s×$MQQy++(Ao0P3]dRJX__,BnrSvbhM/虹Vxx_rًN3`pE'iPX- ޲[Z5} ~]ځ @oRO,  mM?@%`. C^pq[$RhC]#)>>E 4t'$JFx=8[k\q+}7چ:@Ǿ=z(&8ߙ5ܚ A._#,W/-7lDZpOasš\%i vA7F 4i8Fuh#^#w^6etEVA$ nWD{HimMǭW[⶷q!R_Ϲ"-JY|z.XJa~K` }H<2Viw%H,K9h>ҰKva(SAD''7YFK7E2^}+a?Q_86X~adrTtldvPb>:[#Tٵlb0-|u+b5 0Zs`z"ćW|tob {|0422V?lQDUƿGZơrh4ih6u0MZ>de1uvg"^m DacQZ.hHRq#ɣD23Xi֛q@NН4I@qhغQ =U~:3=;j0vm/vz2)aC:6~ܱښV퀦T[hL{a~mӤta!:nga<#*q{/$̆\v >Sm\\NG='a 82IH\k=LCV|Rhښa NĖc,nuGDC+\v#6*.O~g0H5!pIHo=Q!Y~\WėA<[Ŏ?|ܽE6e<rY+˃bL6hSص:1TtD O8޶ZK =0>s!xp )ӶM´1mt6C84T1.CPz>:gsq WTWŦ ۊѨBJ);fYż)w{?5Gc/9Kƚ6`$#Vdzpך}`VFf7܍ R<\[_:dG^Ԗi<.K6ڤvq}ooUǖٳeuJee^y/ʶ (ilo|OS(m\Jt8QN\Z}G0~ {wE"B秦f \j{2NbcA;8~wp:H{{`t쭮p!ӋW*V @ˀQ-TJ5СSI -!_!DžyZ;]j-84Ab@9qv^UjQjdDX8x!~8G"!ÑmLYOOdq]|"j>ήB.p}9<obonvU?ƞXx[eՓT^nl_\DpϋrF>Bgap^z_rE.٫~WL ,s[j[ml)"}\GDS{E(ngF@t[ErQѽ9?|ڲmsZ3jNYAq5mBmD &4аUFOۛ)]71l&@04TWdswnKB~ |{]2n Ùu%:ͤM>,Csa^tݣr.YR{zb/e%д9[w9px_fC$ozVȷ8nʭ3kݬrhuNoJߪh9ẛjkިNY=n rb({^pX͕+e"X%te @ȣItdA_H,b?d#$/%3LXVq%qAB(d 3~.-+\hMI9]ZLB@hH&ߎ:|Hi~M?מtA &wIa+tN^ETD%dH۲Ya$\`HuicъI7Ȁ4:EuIсߒLiH~ɘfCGɦ dēl/2lzv)ɴ?@:gS+O632[ȰĊ>tMYdldf4XO%gV*i%) -WKz<sDdV*HS3lѬlb_dYEw)ijg]9OJZgGFpb# {@br2Vվj.=)Z0Ln#|x@iB<.ʀ<_].jeh*mkH\r.o5cUvȢ7MĈ 0AlLFLNT-7<[`@M7gE"edUPN q*9p~q_iR.YNK3LO9?Hc2dE^:fp.M܄&]4q:11cҙ14OhHT!aqZi^ZB# nb9~6qX}mݮX*"7K^K:1I6 %y8/K C[Dʂ쾝Ba/K.-pw}z 4,H>h&ۖ]fmy@Ark*po̠\ f~3t[`-<^)ӲB ^1o@aZ@.\MOt+BJr憹..U~*&0;Ow HWu Ȉ<Riխl]kSwmۚο1/A|^hwٳcL=/vG5"3|kĵ^=_H&+I]ȁ6$Ur0{-B[|TeFTӶgA/S![Q0ooVOxHdUjӥ;B[)Ʋ>L.&\R49ۺ9z-)5W6^@~C;=:&Fgvz.Mu7_,7pugB.$Cakc$uH]3PW}ײH9T\sǾ4+ޣ"$ ob~ a/sk*kFUEW {aa-VdGYGX rA$FXt8B`*}$}^  ZӜ=(QJ z̈,#D">x0,ą0ѾbPY=E8hJ%IiI5Y v: ige}8*!J{{~fz:@:K~䎠2|Gp8dRo9]'v>4i +/gϋ+kPK7aU8J=ݻE?vb%P/ ygST^f)1/5]JFTs(ʩr^^}$ZWl9NBkEn[!BvsL"6{Ǟk1?_?o{Jk6le!s[7{*t2{n?3\졐GpRw_.3Z2JWM N_gZyX)b LeYr ^N<|YaV#Aܡj(| 5 UҜ)1S"|- V{+g6aښъ5M;jR&$dn|=|'0p_HW0dЕ}YE9v_Fe|"=C]?v ASk-=ۏh+B0?B9@i^,RYk.3Œ|QwGsxwZm Tù\0?f5\!B* [ SC UQ8sNOzZpZ̿9MأNL)AOa y4@0~P>Y]:fu^gH*bo*VWw ^\/3⹢ $k6ĴB\9?9+#wZk\υRq^avi1,E;+^*FXڀV]S,wI2avкäТ_{-T {1e;HfSI.-sY*P`+:΋qKͮ<` Ekt1xgu[9 L 7UW(Tiq؜?zح>'AO}|X< c֮iN`'_x,*X-:*@u1EF& <7M{uCS/s8 nʆb?h>YxdTe@K– 3rBs?Amb:%MJ))J5qj&D&K%eNBXw¯\\²̦:)dVۢI1~VL'{óZ[ya7!k(ͯB壊k7Lh0wXz'vILbZJ/0\X~g'7D»uFk2d/Sbb~d]^c'_hoꥫH/\حN袸镦P}!¡zi Y U2Ў鶁}Uzۥc~{4ɦxopr7+!p« iH0)U7Xdv {b릢уbqI!F LոHI 9FD %S B\,N<*gY śx25ǓdEeHB'q(=ZtQ!CiWPn(?WKms.ю|5#)) ]u+i|i.vZĚFZ?t-Ev ]L:*ǚ=hbJ@ƫ孨2>m gt{ ki`uܞQe\h( 翢~ YO`n$*E._o۷ӈ B! z|M56W1U.{Ҿe"?ݮՈҏϬ־J`M D)ֆX$r3m6 Gpus$0<^TwCN{mjO8`R ' 4MR'\ ᪨~«_"HDb肨 bȭg^xl6y0K\?,pnv-wj[Y6Eo$sWz#~e;Yt 앫bz6Bn?}uh]Gyrה X3[T&Qnծuuq98BiZnvtWo;/nwҏ_\$Je\ujqwZ3fjj͞ADՐmr]%UF{fq$qVª ok~qi_|lm3 )gsb>#'i%ITAJdzdFWQ粞^wl6@GkgM7qIb$mwB'E"\svd~4_M˩f&g5ٙ*75x1<R/`ڑFAZ>eG}JwẄf=lAϬ>Z1?Tx"&~5ewU]GUoxFהc6Re7ХyL]qF]ԫ+߯lݯ`-zlz}TE 7lsߡdx-aNbW^aZ\r+|hڠ{ -vC[tbunw"ƕv=' Uxӊ o zcG_L|~R/`[B>Ӽņ6><ֺ3*}0AP$ t%* 3奋65Zo4J'"D7Zq|h ekW<>aⴐl}$6A pJ4Qm5LBBH`mo/}c{KK.c͂H m@-2 #pg,揻DW n/pPݐ ud85{vWi^\[Ao0!+;S{DIɂZHsy713j82 F4-m a>T"o* E>b-VN |S+/ۋS@&15yP:~FZmlg{?ɢkb6@ Xf߆ yDg9!+/ =[UM4'1ji陾tD,|vHT.?@&Kg g Irc5r4KaJ-{sڣH&,d {% )s\m4(XH|T E cq[8->G֯Tl:wL(ςe-_UO_kJd4JGF7mަ/-E?(憍~&w(74lM$7UV"_^tjz8}68>B6tuѫ3|mUDrw3ϲ=ĿcA;$d,ӌ hXYAivhpۋgg8ΑQ W|]x13с;-kr?7mßTO:Jwd[MfO?p0-k/CUsג]D/dyyDWWd8#kt!COM0|0ѢeĭCB/ 5b+uCNS;%$ms= ;ፊWE YtR*=' VNgP~R7"|ِ,@v#, ^v$'\jq"2wWWI/QUsǣ:\S)aw`hB3, ȓc!M>l lv-9sMFMHrMd3])/ăSlUmCxQwA B1K#ʥbKƄx:.3;d٭]\5G|}j@+:w .+01ނnb$m5c i:vh}nA](m/e^5xMkO~\[NDZ՞C #~%J=`(q\53|Xn= ,RVjKst쬃uγ*ṷX&maJR' e=zW?91[ ;m2L;\mtőy[0ʽn7 wV8' 8i_pi-Aa]MA#Ȼ bFBLW|l=I={kW{ϢRldE,m`.@WZ8J{#%?5Y,CzN6:b1`k)&h.(; An}k;}O@'y+$SLc З;0U_j?)[E D4Ca .PV띢>jPT䏎.h;È/=ΪUD\1eQ&N+|rum9Ѫwm5-q}2|4Aӥg.aK.=Mݟ_dtxt ׵nAb$EWPTvXjBR&dls|Te`By"H0-hjvWt$Ms!)۴ ;JH8I ͋jqa֏+rFCI+MHw2,2|#J59g8&X.@ 1t;@t~s:9`"]z6牑Fq!ъ44-A&ӒhDc7U$|q ͌Cas,ؕƪ6,dEbnI%ɞf 0*R`[`Ѳ4NSae$YI&_$ƹ&XViRqe4M+ /Ln~ Z1hܮC:25hZ> %9 n:B|jR&0f=%aod^]PuKyhdL}neo26z [ҊϊbL2ٌ,s٤$x&'ƃ3f0H /e R>ٌ7TBJ%r(T^Sx^ f^P%R^+tB*&)UTTJG;0MՓytz*=#ft.x"œڬwz /7Nȑ l{^h˶o[xW1(T~n M[!s'5脀Fp+@P"'cʿ{꿀.(w2$"=cUwPbƛڑhz ?dpW Vy]ߺf?|~ն皘kf^9Vn,TNImD6:N>ͻy7"ߪ=E7ַv,FVm3(j6fgg^rV)I <m{F-i d*HAiYlH>Bi_c2)|ۂȈ; >g8*,f.&҉f0dN +2#q&L̠qAAxb`&2n 4KM,$=EOC︶ljhd4űcN((n *6߸W8Rf9/8tTk#PEL¿y+n _1N7&С* Wo~e7Ɋ^eVZӿ}g4<7zgٻ"K2jJ3_g̏:>3}-@#Kqf=I1eA0V]SԔ6g|+w;% J/Xe$Wi?RQ-B3ǘ4)6_Zrb%XWZA86v[e KI;lq}׻=OJP.nY?:8O٨l/Zլ]ΫZQJm]կvJ-w*t:.7x%5W]Z8@sw&CiQḢj~BZzU΋zq&I]"Vq:?*H0kR@Vri0&٘Sy]!yUl⊥q9օMb5wkyj~7!L<(_ɔ'r ~A5J2HAnUtxSmĈ,1 m24+re̡I %}9hJ) 7{/)LL<'1/W8l^a2I.No"sӯ)dd|e1s>:L9 I"S~&!v>0(1m 3Eha{NQi(pyH!pTtq@o e*xA0Dn]gr_[^mUQ ]n2; qh-?Bl [inw\s۸%x!+~Y_nDž#9u~r{ݴA?QP9YVIUրq٪`KĔ|a.;,}u~#/16&ec^mZ~!,"gJn+]dUA[XRv7j]5WJ z ]s}^9Ṽsax!/n}9Lr-t6y^t FG2L=(E`Yy|.%V0t&";lu5qj};[SDS?,[m5<?m.V!hHwxjX=ᅝR2xc[B5?9+7J7,}h( 0<{*(T+?UB 4'X8h5GjLI]]Ůy?^UxIHd'sC8ҾVT:jsV"uh8au M9n4^.9BNx\\ڻY?'ڵ]TjI;R?/<w19R|U^ QQ]tڪjG+vK-u Gl]E;+8eu6[& tiw7Lĥd!S+V|?FυPyj[n|h<-IK8ww3me?~-$az$&;|Fo%ڷoIH;8.ʹq?dutw=pnF'Ê}wk7lg'G·P':4YV ^-,+zsU gh|y) `q)Ͳ8$C(c37qL4s_!?1 7ΰ^ ,49e)ߵ$+it86A3` cg: CB0( JYlTu4Gk+!\e$&'Cix1<nGzcn.s}зNkw`f:\Jꨤ;{BV\ W, W޼?sރݶĸNnTn}ly #3 gm^(;  q6s-+EymlӤo ")Q-9ȳ}m'v.uc11ö ϰソA7pVS5Yb dl,D_`twn)*2C1NB]Xʘ B#9v\i,+A 9(ȬCn`noGs6HX"Z2p #Y0̌عDU H]9>HکpRm2xbf2a^ϝ Xe;hz.+]r7GB܍sFcr2=8)8ҠtQ]v.K@'\U }K&v BC,!8~IH0$0&^.0yh/~ ЂY-ոPoZvu(N0G~)R,sxڿƹ^7}IWJ0!{=F=X_WjN\%r^.=m`~Ur9-v9ۑ׈& [os=3Ss>v4O"h?vB0΢p@FbY!Ⱦ"<;܊("!+rɻ-7y4ZHNx7CǨVVEtEwu˵{*Ӌ6t7^@؊XA/*-iYq`;kos4ΫDrFq%y5EOn@(fSC!]~ ]P~a O'kES,שdx&$&t0.xÁ)ב@_^hbl(pP9qh`=+| {Tm9؍bmC6L]{$1@^SmԣeimyvrPIa,f4|iB^:U2ݟT{ B kF@1>TwBOQdiqv}T_"DpyF{j30Jф{j.lByqnX!rWmڋ-2b J/%-Fa8E[(0qAMΰùxEvM\it̙2qw쟅v ~q3V2فP4r5Z+el7-JVߘ87vlFCm'd@s`>Qzڡ+ {3W4hlݕߍ/a^!][^Gp@XƿkI>H xDn ^}nZI*tcmNwW?=C\5wtGѳtm q78a](< T&xy}X=\]r' n} zZCsYKeܬhZf I4c#] J+N8ԚdT͞Et%q$3H.ڔ>~n_>}AXF~#Ϋ>N3`+֯Jhk& 'X*-؁Ѕ¹^c/ⰁV ѳG@f7·;՟NC#8pͯ]v/FhYύB _~ʐ1B>y踩ܢH n ش'CCyQBh꣩(8&Yi]P]tuU]MmvuO-]{`(vLpw5WSUmz0` ,Ucκ*X)v$R|Bd4 T{n{ͪa`8$ڴuキ_n{]p((GZ~`֜U$E2Xw diV ;jqX&j9(3""Xl#ʸEL5*DX7!'q];-3WMtu].릣.xlrJP:R9B^ɠM J/k|P#v)D%H\pPkFg! ~&Ci͈ha'Bt0hw^OUI8AH`%?V9;[>Q{b]xr{rZxӷb aazQZ*aBzVN21 Gq9s,45wtXIvfx\N+NevxXJ28{]y;BmR?,\nYn]ݖw 01U>l=f4:oCSVgYb t28C `3rbAM,jPu1D :M֝@9]æŘD`4"]"9) lY׈ R- [h0* Aϰ!ι'p>H`tY-#nMetPD+YEdg[XT]2r Ɏ5HlwMN3MOj-UF8ⵕVkJK=Ld]˽z&'OU~J*#(qg5^]=9r]ezA-XVWc=uPOwwo eu/]/.&}yq@7[u0Dlv_;Qv۽+xvM:# NP>+&n[/uJ2LvrVV.AbtU2ɨ:Rr?-GWtqu|ع pX/+4$b.*Eg]#7cߎq&Fx?4N)v`ދ rcF ^QwɷEˎk[ft]/p{J>/IG>dvr5<89-ޯ(Z,oqVmMm btn+yf07d@)&-t ՏZc%c&ї˨Ъy aQ-Q jA"+Ҷ,#5j/Rzob<R \;=KѴ\݂ҁ;f4M"˸hȌJ`]~./Yvi\҂gD&;Be{)vD˜]wh.'VvT ESpiy Ɲʞ<(Zoi^\3EVا]N)7mn8:uwC$V@{(-BG.ܞ*UGQ)3VT$Lj%L_BɠΨ*X7&/TXNLYz3K0Hv_aN3cjM6o"@f#S+Mҫ`LV>p+Y,fEoE;VK!L$dZBu;g[_,o ݂3:yPa8 tЉ7vX[qp:oS@L<"eM1q{^Aشaټ܉\,N$ͫMJ.ot=#̵L ԓ<{C]_&yHyB!=ɧ_6g#MD؝EUR%*XڂTIj3Ԛ}PGti{_Tc 0aLװ&gQpxK lry"|Ks=uz` =I5 ԿlcDF\z->We^k`8Hf\T훶) [7.n&[ PJ"B#{~PTHdi'sj' /}HD0b=!B6/~Vnkň$=]ol'9,p!;>@ſP)*qf38$e(`zez>{Zi .䷠ViPeS7mQHd 膛 od NK&F.dRY^dTUAYVPCP>#>A@%qPEvn'dzma[<֌(칭=f_Vu=0h 矏0{ѷ:u0_h/x7:Z&/ T5,]$jC7q~1,}BU_ h{.V<颤KmDfR=CF}c1FFX6 SWÆgrzmX8ECfEs,@E0:R);d|xB{B xX{&~@\ưǟ{rVȻ ΊJQ=;/,IX2=:;Lj%(m [Vcʗga-̣QcXFw #&֓OꄵB)Է(̥Zj!:FHGlszh 3yw;2Lny_GŸ3\1ʢ;3 h`D%#cAh6IM2,vFhR`skIbH_qb] oNen8=pZd _45ac.s#Y,"v*p,p2j[uBβe"s0 `@l2WKf8WѸedd`et23!.qs7 ,䜺3'd !M["i8?:ӬV);j/|p 6f+3/ώ9,Fif q Q11dc9я!s J`$>FbH11vrSUeql!*ɻEM + * };]a1pcoЙf2Fd(te,] &3If3F\d $1HaevNR.lLX [cX 'CD=t8S 5,hwnSFonyylj讃)vSZat>uJrMO+MU7PÎwa{z?а*^Vo=-_(Eq1{-ؤX&"q\^S'PeWruMu1^@@ aU@iFSC|K͏ۡ7%R$~pB%W >qVO۩^:KyOjG84)O7ɶޢojzԾ;NG{v<9ݴʃݴb%.]rw~*730T< 3I L1 ̌E&QaI He4 L㢳Er,04,U2 -ˠ Sօ!%=1 LS '&`c>FaԀGcLe&&"0 0H,˲.1$:ad_0K`XpTf?Vu?. > M`X[v"qTɭзB,~WI‡'2::Y.:mYbk .e\ݦSFL0csV.!T?WؒC@2PKVq=W̞yw˓i {wM0ʋ]W=a"md>wkC~}Dɯ% ܕ{aVi;f+Æj&Ƶ!$gK"7uyQͿ{*2=*% z6xgO]M˳{85 Za MԵ__c}לPnkiPC9&-͞pno /=l)G=ujP1ϳu.CI7D`WS{KS7足㻗bK'ʼnTEN?M4`DtzVG^-h>ukXe!갽LOQ̀NX[ڔ>Übq`q_PXû@}OwQڍz*NwH:{A?dmn|mN6AN~p&?t'? 2م8_(*-< 类_2liN{^LK4_P. bZ-B4_Oo2._}pr[8Sg+c#AgmmV \$YgmgԎQ@^M+`mܹDm=w'@zOFtu>Sa 3<SH'SaV:4?K= C'u[,ZKS3Kd3 QL!'.EonmN a iv%:1;P+8NNgǜɷ"e[؃/qPx_k#]r@.Ya0=;Ю畝gAP~3ҫ..NX3n\K&ڍn^a]lU 4惤 vYHceHѲTC)5]Y{gO0VTq_ͽL:-fsRDB]ל(ǫ`_}A0{1|U!`z}m4 m0e>3;["q<>͝Ǘ0Psvp HWBO=LW!{sR/vf;K 9W2;%4Ȫ=c$W􀾚-]QjLJ| nln|~'-b0;q!l>v 1(B3K CP `ks7 t:-"3osu^_@:W-Nm'ޠ`\-83ޏ| !V 8*C7x'1\n6tj߉%tbP7=5D.!~VmFסkFt;HNPXJ(Ba8ŴzVU:#+|@:^"wJ} ҡ0w| b܂i,0 쵻Ej]B0| &U/77Ծ'`|U_CyUp?^{y~tyⱖrWح \+Exv\C'fkdѹq`鼋CM,jq@IFɠrq[:%Fx6r(*siwr{w?BRǼ%:I|Mրw^ڿw.^b~@}ȇUx|?|dwpؕmwj =ʗ+ntp1NnyrZuM* .Ӗ;;j7u68TqxVڅxMF'&IM5--}WHzI[2N*s}7EE ;+D?ބ!mm*lOw-,Zu硜$MzJB\s15{*`=#=̡y֏c7i`-Nٱ$CķC {ʯ-髢*LUaLg($y'poFPG$: PcH#yԲ>2m (l[,$@J&}JV  s1~sfboΤ?*@5z k $ ڄ+% {7*|U̙&ArӏG:nF$]8 BM ;o#J ikݝ`t,wwL_0'Dieojq$ S ç_Nϫf^;Ele]eKʖl |eґf.S~ұf.P18rT~ :n샸Dž2o3aSNnj00+ 3HutJw`E|-AƒK%?Xȵ=~ k2%~nn]EYն9~8%N-/IlopE"KbG(4 52@#c]+}'H&\d\sx SgT38K$sЩpXc#1C2Y椪X-yTQW"lij.m67ə$ x hfݒty>~k$*yD5]RaQ31+ % :h',f@U^_ЗK|6٤}se?X{yE+,d,zᐠ\a„Qq 1f nlQ/|8,-ɋL&bZBj.̞5s-TP(}FG\{"*c ,<ƿ޹= J黠>7*F;*Vg J/r*珷,3ޯs>|l<3܋? 3[5A!m9$Ix[~ cZlғ41$ߦh0@N?n.ٯ@?lq=w4]R4e0||d>Od[/Cu5/%ͭ{p}S;0_t3Ū(39Q>dtwJuqvDH\[0wpzd<>:ZFGU;8>=teE\Eǔ`"qӽΎ}`w||Ebt'QgmS^-'uEO)zY$OmQtB8gIH_84صRaJapيk.S(ײh|K[Ab%kq(F\)T|;"i)C9iԔ!,zEX&ZwEUVxN70X-Y#C\O j:y~T;>BՃj =Ӿ} z1 WGId%4,A=YZM_@[t>A`/;o9#xZgbKR8:7ͤvT|#R-'I1{ VD@ @>5=oJ&eKArj^c/x:8)Sr{:ފkO.~ZjtERfܐ_k 4=Q $0+e"H8O_'?KO, &I3${6+S~?kawu[_uZzS)axOS*,_gTcCIypxj׍sl{7J-Ӕ\ɈޅYU/?=*_7`Zm<tyѹ+墧<>=3m8.d.pBcZh/!*ǵv>W^?-O~prd}tv6ú͸='pFI^mq3e1ATF Xdv"U_x)$ \T~b.:oKmUTFsey\JXdjY3w}51g3 z}}8%o}]WmOF\i0-mnE |4)%8\ɻ r9=# /Z:R'pueKg=MNMiSʨt4N^άY[8Cg DzbܥIYdKÆdir/d}E:ݘٌ'74nSÎcL1Sm#}NVtOФq1ZnwktjVB^ʲQ5yӻ$BBVUQjvJna1Vk'|ZB2DNr_l׋u%y1ϵB+OR@R "5= ?5LN7 i% 6yeX-۶W!Wm@3#{+LX9JClpB=idMRZ3ǃ, Œ=QȰBM7}d̄iKnmg2 SeFH ݴ [_/c?M6hDYfO z4Jk]̒' Ҍ֯VF<0]|٭7OyP߻ȝ?2m0힖G;c'u[OɑDkLv4gꅛAUJ͟N^YZϝ' i|sTƠzxԹ NO3FH.Z#Y.^˕br1tX_;~QlnsíL1Ǒ2fkʮU%E6Gu.:_Էzz뛷Tl{`̒=?U˧]g>]oKլqs|}}TᾙYP Cq]>_}2x;ZWP ;jc=Cިƈ+ f~M¬I`ӭ*Y%+YvgN1%Czi%פ>nҮ:rh9pO Mv=NRQ 46;IYT+FVhbd ڪBu@ns@) (]T_?7C+aT2zaζ8QR: n^(S*e$R["Y໌ܓis|jC$ٮԕ)3PXꈓ[02$[P2}dїww Oۻr |H2믲dJrRTUQNiWUw~LZ0B(6Q&3+wջF%#o( vyb҈(G[hqoXsCpr}#k6gr]mp7E'IfKɟۧQ&oQ'rgck/3|YϓNjH8mlO/.; xJjazǫι|3j*s%OR9ӼHJc4 ϩ޳2IZϏ.*gE/ 0M畋ǎTOL>{|qz*'Xlƾ:8v;w#hNnjZ]dlRz(&#pZN塔z]%WQ>r'hٖxXɜ< ߇~zGX\pGnA8ܾjֹ!;I Ôet! %骒nq<9O^fj{JZ(;#19?nz*W7~֯^;9z]43$ mgBk2Rd9i WGcw5a}kk{olu[D .ǝ_<⩣(mi;Rvk?kpdaĘٺHlٜsHWءePld:{wά%x -\$SkO}Ch҅mq2{Zs^kK$Hmɢμ^/v!&gl3G/F['C(RV_) S'Le}7f 8>6BE2?ؽ$96Ms|Q{9~ߤULۡZk}!:$M5{UT$Ee#_R|xX`M}uC"KL?xsmFuU5uQa-ԚC1QR~6~,(.TR{_+0jmI˪)쥦)6K+mCkPrA%?MvzhTkm2TLyF"ͦv[ls<>u{Lgzdx(DΦih_^ΏJzK]Yn_/7φ\ӊ@+s!ŚL?_(uNYg2G٧~Yz$jw?V핑<#RqP0[7A|y}y ׇVq([he+;9ex.ҙ #ڒWd ق:vȷ6"L;LMQl=_aG7cgӫ@wS@z<'Q˅Kih.>{rF 75jڄ%#)Ƅ ?⊖Tϊ]F )w:Z}D?~ڑw+G{'ons.vRz(]dg?yv/.wSN4:y.OO/Ѡs*6·;Wv<д3[|Tk;ӫř_N6ڏ=cf? }z]ZawWFtϔE{Ę̯_B?,LiZ|?[׵Aå=ƒSŢgHwwRn_ga=l@6x.Ls(Kw=8nv/zWS^gZ+tJ'7WG~@G2p18dQ,ux&=wkSγEr9F)^6ZY޿ӊ3k xkmkJ'q^e<4FS;0ng{ӟWO7צ\Աs7PDК]Xeb2&ī[PHBmӴ`*%n-o)010Kc[4U8sR[>qW-iQ(}+Iw?5{͜ep )}C3Z~L-9T ZТ"|+ՐGm<|&^RD]Fmy@ٺ?zU* V)Mc2㣝no^eLBSұEZβf+FErP+Q+(h^JfWءq*EWƅL{At-q"oSg:WE  _-uH0`D~||Fyp,j%g2cw۶)YHϢIFd`& ^I"ńیen&+0D. w]$5t&93m~tvģzv:*_斌?KmUO ?ygˁ @pI8A9t'b`M,i,ߎ*oA*X,ܺP xGnyn.mE[cD[D!Źզp-YX%;.Ŕj|Ш]dXh6ku@)$L!+\..pB SY.NoI xDHS8UA |cR9 f ^ebz08u] xX\HTMh6U%swnSj6 z۔MTaД-3KjdBV TF E\,QR":v2S"x C5C%Ox]zaNuf+VG[TV7=,t\As^w 4&.yNU:DYo!/e0cU}dx4E=NB꒡)URAm#que|,HNm2ܿfj~e<[W !Ϫ{ۧ>TSä4QDRg!↙k:D;2 Ih"<9C0wr d 0+EX'ôS.eRߑA *Ӳ[_JҠDž%Ǖ+.IN1 Iq){Lm[x\ҸA8?NK~ye~8#*V2ĤiUD?~BId@Ǐ[Y/PJ~ݻ3z߭tup;|BX*赫맛Nr/ga][ZZ8 jado5|_o_ .Vp:^`>:vOzr~0Oyq|DfxR\身Uyht"Fj@jh+J:I Tr޶0؄LփBSȺ{Pgh"㎪Uc'C- MH,ץe,4żC3(ͧV+ވgHG+UW7v=]t 1 9Bmꩦ8 f9g(dh27"<)Hֶ9b[/-)0G's!msM lk(I=Ɠ͓z6q8XڪzI̎0m^K*&׊cxj4Ա @m[KP5##עB _%umۧFE* ysB:E!'}26fOdyæ jq*)ès.G0$\_Uoڏ(.r=1cG/bSUwIvJK@HZ1,d̡ Yiglj"Bm0F߈>mc30[6,WKg fݐn,ѧ 2Tט 0K"웽g"@IEN=Rឤg:IhLb#Wejɵ㶬:b1AD^X,qxKR:-@b@&$oh C/˚f'&HO8ICnr!$ePGϤ<$OCPJ2lC}ҦgHUXj.$YwcZ:B :5=pC h&Y}0lr6r>,4R?ݎ /(u#3 L(} fI4q-F|+or* `ZxrJ_&?F\WU-N|]uX=-+GAe(UoT۹~Q8lݫ4@o]՟#x#NVa"*S.-tLA_*q32f%Δ+?SL3h3R^PX+ڜ_w{PC՞y8 tȏy|>8>b|lIrMqi-3UUkVnSBk^?ԟn̍5&wMHzqqNK[=an4aشl@giU{VB3zR}<6?)ݠ$jxFG)?t[o%yu1T&j-fteifӒAdF!K { 2Je3!yS5aNyzPPR3ԏ0LZaZcE++&S+4 l\ ˵LADSoq~  @|_K؄}L?2]R+rsT tM`0178 @l!}=M@_vQ͇AXQG GeAV7d"wn横OBi!Emw m+Zc|-㍙$cMF:)CShBjS֎(hDi;vc"¾3J5CQRu@[!kDQE5Uuь#ǰv-H#Zgy2͵h\k6+RAWfX%8K,,]G]*k`a|I7q&;P_)|Qږs7}bk)DP3cf^>F"E%M i(XtQe 0_VY,3>f_W"a_v6k$/86 ~GB0ղ59o:I6yq(JCa63KX^QpdOhE"Wj_ e0VڊdJ^kZYվwS"sBP},H'gߍ7NzJ͹AZn%D:rtv>GoP9AUZ4aJÎi68, kus,V|P*]P^fn  |: m|tt9;cߥ-eU!'+l6\|_[D³[hqBS3LC-~4E}[}Mt8ќ=fc(XrW-lf="d6  Џu UvD5 %fĶX# ] x,l+Njߝ]PSrX03T>UɚNv"lUf;.`(ԚZ`>11wxF~Q3lWGgMƌɍ1r_%(ëզ̄kYwl4Ϭ_+yf?y]Т;młP3֔ؔqGjθ? z>c-y ClO{`ZQ*Gz9%~,' YpZ?(Q,jϏjuIMvTЁtW-Q-pҕWd$#1;;;AꝢ&)!}h;t33.12l~-"BCiw3xwh}z >yQ sn ~^͚I OG:=֞h)&\Lͪf믙&sO]1P}F~`DꅹK,!DL)Ȓ{ Y^HjEFBS)oN#B6UZ"؈-AKH$użQJ!, ':T TIMC:OAbΉʒ,mI' ; ,B"oG[))xׂw`!1ydҒezE;IwZچpKE^.%Q^pgGcQrRq۱v@NQANx[Y} 嵡\*EY{ZТ+S`ǼUZv7Զ %:Apº].^?kDVd pq3 @BY>8Umųa#njTJ"ruoX ҾiNq7 Fw]1j",#pVC$p)ˋ+F?!ݭ'g  d{ܨVʕjΞon;=BYlVS!e/RJsa0 [ k/eJ)f:h ^~4M#wsgPo+7=3"[4*\7C3ggF _#E|Œ> XS<8t*BEwF(f05^=oOnu9H([7^_e.*bW߱.w _}d:UlQO>Q.%*bQbrXF Kay[䁥6X\w-cy9 p\w2+}q^mKRP[2m lb9TP-Ҷ8,rcNS8vV}q XO#^K%V ybWzq9'5xv<;[P2-H9&<)C δDG&呤xG,lyI[-8;3nOyr$\7;} hlFrwQXYS "q-CwY8^2G_zZM&SLyV0PT-YMQZ5.a5,gBKWFmKlǪC kڟ-wT2ZPMxd!b;Bٓ1jALEGG!&ؼ!.«RwsheR;N= b~gHmL^}%If<\X7ݵQ=ef'S}bSͬtΌ^q :'p:ZTDtw8 ZѠn9~ސi`/Ρx&k_T99:р}8zCӹB>Ztz UM;+ ̓﮷#sG`ᰩgwIO(|{jf@J 0U4MZ: 5CqFd:獾 Q >V;e9G1="&XV a}}}ȥ(Ȕ*q"Mwf˔etuwnq|;8,D+dtWmDiEE"syL @įP ɣsv >2w:\R-z]m+5^l'2۬)MV4dq2љ-2MSsmQ`wlt֐7}I1p֘"xUiӊ?HD~ȸVO2֮HsXƜra C^uɐI6>z1$ cBdHPXd&jHJGSR"q<+#{Rә$FkͺZ:[寋f?%L.ͣˬ}kҙvς07Ui~3bz L_ Vunp~w 8PɊ)D,wT13oׅWD`.QY_du}ryg2 )@,=R} {Q$8|B:1U8甓=-hGqD,'w :bAn`I=X ⓱GǕ2vVe&B%]MUՀ&\:yʈT4rrpf"<yx，A>$7z7 L'6e:gQ.CN9\rQQm>4r 8CPoG>;Z^_ZiD1[(3 mTe_+Ir]e>IːEQcl[*|2k-ΠxPרZ!Z # >-Cȿ tQ&3Efjg*d<*5JEPmο;&UR 9?6{-ݪb*f3aiܥB̥SI>^Hr-~=-Έ|Jt<UFo9}$&*N ^U-Ԕ5$+ St )o} T8h8;Ԣ 8DF36{(2t>qdF^;9CxT>Fq&ZPy|lkUiKP?;CYO819=S<$6mH>iߤzЏ6ݎ~$hiVYXJnNfM_4A_ 7mh n#G/Io s7?Efty`\*nmuuZVyt;kgNJ֞Q|k?~'{=odqʸ|h^hɣ\qP즮;Q!^Ҝ沨T|Ε~ 0pgh׊U_0ONr^7ݻJ6]_8i LbkRBD]zYUQB&Tix4ƌmNCE<TSjK"mվۙKwVJ0+7 BaX8\ig9{qup:?wf w\2~o{o+Oɭ{>|q g!R_OE9{tԾ:ʀZϛuE&^=pYѸMe2Fid<$*u/?n ~YU̘Pu;ZY}3]_ƥS> H)w*A[@IYp|džRO^[OW~jCAܾBoekj5#)yw .rh@аoˬ8:qcs ʢ(.M6'T͠3A8m:(hQNrߤUM0ލB%_J_Qǟ? WD(9tj WsSOR롉[C$:ɾX_Fznogiq>RZ??9]Gnגuqrf͜\7Y{*8wLiNndΥd]/PV6_]y՞0׬^T.ŎdܹQ?kNqGbXI_]QB1v(*7Sgvr}}&cUN_O<UU|~vy^Cz=Ajv%ʵ9ʶД+| 4 9~ !;є $)9W! /9[}?A (1ie“dg1 f4Y\68֏*C舦& \4DQp"A0ۋCn7"w &}Y Ʀdsrt2Z_q_/ujar2`Ty=&9zU~7ɳi3:j *uȁ}-7tXqDA]ᛚ+nF :zt7HtaZUb4Ŭ D.aFYPzw|`xs{wr9Fg\nsx6EG!MSv=uFpt8XۙQR@Uir3`u%,H.D@xFy:7 뿫t>}?=G›ck2wũۓRm%F )`)I5;4l/)<=v!Y"edN+\?Aa?)tH0rB!/F+JqzYt qJ^6`FHc紝y Bo PV ;&Aok?6P`_ $ts6U O8v.~Md}I.'{Y1:<ޮ*mJܽkCs.:@/qn0c%qCg_NzW!8P8C^B9jYzfYb |rլWkj1ol97D^?7g[U~K;&>tϙuV˝qULjE4d+=|{GI^.n#ge?#d~MH?R~Q;$VMRyq٫z;Jw$ʍIΫrsKֶJ ./#vS?J]/ۧΙ|\Je( = 9Gm?'$u= _!:HGҥL &C)%O)8:$Y9e]- 'J6dT)B,$)B4+tPe ۆо6!a xLpMn4uZb4(~B7 OYh_׌W/ يn jCEe' *BނӪ|-X ZRR==̉@")ǩJA}t O*D=FqG5t )Ʋ>64Y2d)xt*cݖ:}>!i2,S->qb.E>[B&k ,;I&ɳΕy T\oszFRTi4_>M@@PjkT[81K(Fe FyltYŹF3qh6Eؚ6 h\1Kj|.#)mG̒,Aα.IvoCmzcz[~sXsXf 7E+10™jJ* 5ji4יM|:K:"AI 3/&alXT0CU"؄g-srƜ2e qKGc#~zܒgR]U%B1PC.=6A,2tҵ!Q{B0lq2_ 2Z]? &U'Ù*~c@l173F LI65R6EwT(ZRQV14=GE4IbQyRM-_oE}p&\iE$ejΑOoʪ8$c 6=n87w_#e"G:C{V*@=FM`r6yѼ?JAFZY}(R $꣱Cd cSTA4e0Ǧ>H5<-6lL!t3@tGߌ&.vAMQ.ﻻM;e/dQi˯4PpWUP>4{-sx'/>v*󲹜G  [vn0Kqp?3V{5=χ8.hSw 냒T哓L^B Yil t^{_ԉtߤL@zrdȖqOu@ E=PKIp)3 0FtmQbHTC+( 03lceQQΙ}9%< HE~*-^{Z/邢?pi łSitSliBBk}QK'SobDD(dl2CiТ^×)MS$Sz^ H_oR(\Q8@Lja*nj@{wf\|lq5Tm5+L rQ*+0Vֱ6ERH:g j9ݧN$a.{ C#H.R$W6~<[/l zmU*7*0Bˊ)phlFw>AƟE2n܇}9mD@IʨslE#a>+?;1"6N>Ux9rMHco~6;9o zR,)ƿgU@ 2CYL3Bc|X̬|KhgU{9Փpxq:|NőPviKV;MC@ZRp5 ":L]"| kV|VB7XO1)82+3LTeu|~RtnaŶ?:m#{ش;lKQwh#~~`m.34$} |H*:_7Փrgآӳ?ڰCݕvqWVUQ)UGnqvЌ]uhd.,MhH6oFW|r!I<ضn`v~jp+]ik_lܥՍ\ݗo.H]@^ڪ]_?vOLi[;L]Fܥ)(iZHvwVe+wyt> uv徰[@͛b[:B){-V֯=~L@h@}iD_ZGysI6ԇd2݋@)}ӡߌ8lhϛҌFzjAU5JQ xule)inbU[\9w!D9Z*+*SaƅӠ۩tx4L6+{㩄Ďyd?^o⾣$[,:&y25If)%F .j2NjBrRV6J(_0HS14$K4dN#D;и6oTI^:0TjNd<k\ dԾ!#D@rP!)}\9?D;+<^La,f|CaMk?k t/$n>ߢdF $s DOQL[{"!Rn2ڋMKdMLӗEy3y%nzo|J}Vw#֓7ݟiQ.t$aQV;<ְݯ^1Кh" ;Kd(;y̡=jJ@ry6ؿ̀I mY yYul[L|C7">cN"'( ;كXAt)D j2QZK(-t@]8u^~I'&0˧`NGccac_T8O)S3]:,_]l t[@]iNC(C<{F`@3]e5kg_N]-؃kS0IZ˂xMb j6\hU'F.y,i/Z&l7]E|L 4&G[e_D8$eԕ&J(,<|k:NB( 3:YEL(0!N8]d3=6s`(ڒRTA%y]|k-“F)] ,eAȪj;8;R >H2kP BAJ$Ԥ&Vui8M_ I\k'| wN"Ы 9๯+|0Bf=Ak7!O ( 6 b\>7@R8E8yX̼BbwZVU p82 p裠)͆QV_fKt@cŠk[3ZoWZ|NFIƘdBgD)^~iCO[,(!t-CN^/E9WQCr9FGvG i$"SS86š7-LGVu n*L 7Du4UMKai}\ER2tTK"ہ`DBrbgE!`sED Y_W .uw/p }q#4dQwk)+vZLܢyEiAf[,Yc?B)ߡEGX3a;!sMj|jɬΦ*sX4 nOjG6&ּ{^yDB-+:u:Lm#ݸ>9:k9v֫E(BIR"Nͻl~rw|{` |pj6*VZEca"f%$ZxLtEd2IZ,smK\w6~#NPV!1D5'6"H<Њ"6G`8hM4uIQM8rE1cUo^9G_.m#0=kbҦp%::iJB3|f G8bx`\dONr=3H]8}tZ((4߂ tx. >N]_} /`] WK~f.(ҿ (zT U>>>'g%UfY9!1y:`0@*VvR Mf70crmSu oCYPno6Ǫ" :Aq=r R.KU=M|~ 5J¦nZ$ )?QMFUqLZ.*Qh0>DO/ϔҬdJqV/xhWyPBƀ0#+\WZ [llxvb{)\nPm8}U8-K[,TB}\z }hAB>O9h^dOdJ,a*}++=\=9\9(VpfiSB~C_Ρb06͚U]4{l˘Bq b;LD Gɪx-b `/Dҙ-A/Sm&<`u|.WwOL+9c'jm) j- 22%AnW}r~@iJ }ȒB[TΆ 1g=tlW /F|0]qMor:Ң{&UpS$Q/us;-_;ԍ95vS B-3i\.`.sEK[l]FWPˈҍV~ɟ|M9=D~1yyR;Dٺ/߲V;`'`Q.)R`%4 d)J?m ?wG\ eW zWFX@!ff q39l{M{Nfm #KD19+QWw*hFyXtQ@Щ2r+J$4M[ Kn9xw&cEHcG7Hd*L5A|BJ_JxN@/T]bXi.=IJDW1"r55jH|JE=VxeHx E:άaZ#V O{*wzQ AKkD_rfF'J[+U)BwN걵&F -њ@-ԥ_CԅP@iy4N95%͐b8y5Itq~jT#rπ$MC `pPbih酇̛pF 1.H u#lZ6r$zIPElmX LdB=^]q%lpƴ A*h}j Vo"T2|L[PP|&XXA˒*gmY{CcB?:~C|r4%xPFL4ꐓ {Va.Z|R1&Kctr˯%6+뒆bNV1\1@1C9z*ҙlk=ddeGh gQOq(|?(*_dOݡ6Q@+zQMQbP [Gtߺ#,n2Gc-HD ]f"OڴxBS~9٭v}!)q{$>dd?*bJ`JWE)+Ggt^ 9+ےhՇ9i7[aLFbs=0z8ڣ`ZQNH54= c0ڍmmb0iBl 6TU#!E] ub:e S1JB%)![|bO] Jkn,h D"Ԛ/̚ף\;~KS4yq$D☍ GG@t]TA15pE& CL ZK̓$ɋPj;u}~JGPlh?0 _sz~1!'(@"hUy( {IysgЀBz%ZgLR-a3UL{-A.|^ZQ)5m 8S `$*hfATi<_ Qn k. 6B!TmI&p>8O U3PTy_r oFc\:Np<䒞~G#vУE j"0])/'oeapwՌ-uu*VQ@?U򸣫Fu(t4#Mbb0q@]<,[ߝ8AZ !M\~vJmY9}N4 y ]1 ">T5vA`.QjY.5ЅߏS(7*?o鹛MiO~gvH|v1VfҜY"]҉7p fkC1v)l^dkhⲵ Mk1]x79*jd@ˉ *W*?Td`|"'@M0yY08TuK}i}lzAL.|F8<\ck1}&V\߱G1!jjhlAshzw7-sbe]нk|*qw׼O|PN$9B˖ZeDXRAS I~mQ o eq(/aq-( WO)H: <<[K9C` -Z6g 'nCQAPT xU|䠢4Ђ,U:P_XDVւ(@,Negyr%Z<Egpp]%. w?O,+:O{ 𑆒X" %vj- &v:A]Ag.)䫳r{*d\`ۣJ9fAh/\ўbʲH:m`!:Iګu@jN"B=8xvq)6պ]Q k [/mVJp'[{] }EU,s=x ҐX5n^%hw>F-켹=TݸxnK MBƞP 9~2LN9*x7H@Є@VQ.ʣؠ+*ⓨǸc(6IJpf(ǫ=6GT#Ⱦm|⨾X!qFӹ$ЅH'KB˂"(&уR1tҡ F̹U X*)0s*g ^S`XcxbȨqh5hՉK `h~\ -&Z5g `IKʷZ$;p3 T( _54 .MU4|_Ƀ؍|g4a\m8~5lE%Nʍ_ 44P -IO7e`Jyh|n|0Yȼ󬼋 MOh۠GiHT }x]G F% y zw9ͽR RRW: x zTdBׂ%cgUL62CB7(CS0l.P e 9r6e#"͆G "\>|`֟:)sgmad:+h g`eҹbt>IB~ɧrz2SXYS%TbʓzN99I[ϩb1oIu'7zօ 5nx>3t<mRI5^pxnXQkB!\}܉te-j_>R]+_/c,^SU`.ML5,8Q%jSDl6萗pш1vU!UHYw}w7ƹ'*qfZHf7&O"TWodh(]AhQ'GÏ@w!򲊶5j2Q|>E$),إ5#7 8 q``V@5,{mkd sfgx ZtjX*t΍bइEJ-p% 4d Uexz6x8 ˓K ͧx<{V[8?;F?(% #d}uY 3KćD%,9y~[44UQAl(+ DކIlR.6F0fV28O)WlmH~m(lwض,*:Yh\IvQ7mNv3'x&,  %(Jb'DN^j4B/ς !bCFS@%οP=~j(K 8ԜiZK\|?b{PSuZB^)D:8yA q1G;lyWJ6ЄO}=-/͝,Ay5VGA.OeYm6'[%gkbZFs5IE`' m9,KMMX]p0ݼbn] 5?E93# EƕHemG~:!o_O<9V8)%/%WE_mbmC[ \PMg?bW:_?lqbYtdS R``sol7oz$qlñ!4pW!e X|>AX Q*"K2`:Д9&e4A!g~2ˣ+?뫛.>qW[Iop4eDGta#"+U͇ճr$Jv:8] u Y0m8 6yZY3Lx=A,gRvŎؙ{㍃sc؋](qD^E*%y?R,&- ON$[ʖbZRɕm.I̋}Dd!S|'Y3ׯ!7qDvvK ӡ'L^%_cQ,tu f4ڡc9 ߲hlKB EK]Q-JF Z">RIDgT]u $d8HPe(¾y 4k,Q7_Ύ3o4m Ƌ! TVVxQ JUo|gSPciHF"o׷6I4 ZیBK?8mYs6p1xԍ4Oc5c׋<`&>[z2i4ʯL |[9rC Rh& yO6rkl E~)rC+XOzP#;|%cR߰YsXH0SI}0 Nw2y7Lf=Y{'/ l|"Zp&'ǰ3h+GYw@slgOOr3:!oСMParT8'J JPw-JAA WDwv|~]% R@Ub~!zڊʣCvQi]蚜H,bE͑h@PURVb`*S"VeuKۢ2BiDnZIDpRn?fEVUe$Jg#\, 82b`*bO3ETe!BX|5**$}Mt"ʕ٨r1zluQL"p}szV5bcǫl/. MBD% EN9B?ڼOp3D3eZכJvrּHy#rSA8Ӊރ&Ma0@n -C`$pn(b {dlCvuRydzKJS1.-^s#,:[HT-]2Ŕ.eKfkډbqRycܷ{:I`Y^_d=qr;!yK$ XzkoG X6{?L=y`GnxǭJA?DFLTdFjR=:WV)IPL{t|wDb9 b?=3z:I4 zR{~R^V9|j0A?I\6΂}:,"|Bܳ'O%}%yLMKǬn}\9?5W%|#/rvuѠx:h:9>la YXoq.=ekA#=$qcM=q sb^dɣ~zPs_"Itw]Ɍ Tk&s[]Ol.>h28Q_z[\J-o'ī= 6ĊwKXm]^eA>] Hk$%^Eևf= jIKIѴ6q_Xv/15VWŧX8G|ƛD<A﹦p3izfə^ 8[\8Y$17y[(ˣn { b`ַb!+}T{,oq$0zءа$,GqD.(F+>Eq31he +s5%Ӹ$K$ˋU)^ l0FŐ =ya8k.Rς}XhxW:LڊU0`0{vm{mP:M,u=xu xD4Vt4?gcviuyS4u e0Vpss4wsOX).+n- Occp}oWۅ)ӎLnk'$ >:n#TI]u'xD~ >ܶvӆF7" Z%Xץo0|ھ}2nxQ7jݦ&.^{ԣfSSlhYx^#%Ёx'з߂S|#m|Ⱦm S6Aaky}%ks[XdA!v%/pѷ,^k_Sf_%m;,n釘0} oA OK0nz)c*bd@F,Ϋ'F8Pc’o 6Yq{Ũ;v?`YSp阀vX\)/UDyGEhwzajK8rL@h&ZUgLklj˔"F:tqM3=$qlra=K(Xv2 V5p3|)ɶ|mq] ³ؽ7-“ }mame2㒳h%KգmHؓ64쓽W {ů}z/b.1 KIH  Ņ7^4wLo֡C`D V-Tַ{2Qo*& i,@&nAؑor9v//a@Xb5{8[3@B-Dl/Q[qfޞ@ѷtM..w†%'ZO t`쟵13x0wš"8=-i7F7?:<W,D)|c~]d!7c >a4ߑ'ETw<*@F qD&EdYȐ{X1t;ⰢY&8ZM}v5)q1AdHk`6;CmtZ"a[ j1MFg}8*0 S9R9 S: Q 6D*e<)1k `,91f}IiFv+*jkrد(.l.E#'HH8{Ew Q/TL)ri[2xrnи%˯>y+D5p A؆. h4ͻ@ǖ' }o$~o{5⺪{9 OU7EaT7&s?=KS0#{j϶% u+XL^^!_ m\@ (^V9:=kDl2%J,M9?m&x ) @^#YXM~2+kFHjPBk:'(1MPuBZc$F Z)NNbP@Crb\ dCz=iG_(!a8)MDWX@+~XnnO+U*hzz dҮMq3,ܛA6xǦp]3s\5j],:)"~)ޅL5! &Ln]!>hmLRA^Y|۫Ԏl5/1n[Gϗ6[bPI}V7#p>snqu9:1L 7\DcL]XWT8ضhc|<,Oyfu#'dV0#2 fJT,;#uNz UÞbe8"!m0Kr4,Ut9jeJfT* XoK]d:p`Ѡ]x.(rr0W*|$w6bʉkݼ\=X7]D _Dt{=x*o0`aG b 蜏cEHY 8!:P:E1ZJ3[ `^\B /"f#LhE`oUF-Q0I\v* Dlr:26n.8Y֗MIt`]+grښj4 FZ9`5aXxvqcrVw{zF5~zhejҖysUW[bMz3RmbJ3*?wݪt0ZVJ*9ٕEg{)M:Bo.=NO7u a{k [ljsBq}$4`Mfeѭz>""-Mi/)~=~h-Z'f3!<6lT>^Ϧrb!. It*/ \jAA i( 抅<%sO \ljܣ fxptקZd&'|!2B$j}xcr<.8Sm"'@!pQ&Lъ3j'_{JТtU3lZqMǵڒ56rMW>mB&%Axu j0 c@:}-,7bJ|?j$aȭ矞/vRo>{P)_63{kzgyv-[i!"p"(Nc-fS?_, )*g??ƼN"*ĕM`h.v*clMu<\G &&@ A*aBPUUHfɀJ Lr8{b1Besħ[SC."Dp|Zr;K.h$'rG -s¹I,,W`ı f&lPJ`klB}]&o]"/_FWX5 ljMT3YŌ.]΄ &>FHywwnQ䋟_ _3xL8v,P|u#8"PZy1")Vܔ * d8j?ƈNsP~>ޮeH;T~WnN# ǂ \$ tv2%a* &+QAt "ЖV{Dֹ C *_Qgd to:ZZ9k6g f4zZ(?ELmNH3Ƒ@Ɯ*N Y{`* |ɜ ӉIO$X?Л?,s}fNp1f '< eS[Z_j >܉tF2/5B0Xtn冚 *B-._{؃ "-ځ "ցO4 =S%ꡁGZ ݾ.4 "L[Tqvw6Q`#pĴyXa*ո}yM#"K ˚ (Pro3cfW`ah|-z#< c눏2+O>6س5-D#Z{;HZa S˙Wh !_Q>bq5 X`ʱ{bvqN-i>x*}džQ$e `ȟ&1>1ÇYaJ㜃DH-= Nh&D|4ab %#vYx{oX PBL) ! *;ճ}ylՖ<tŎ|Z?E_nvž<9j'KONS"CUMW7[eZKq3 =='xw=[ȟh+%Y)C-iՑI,UK%A`2KBK%ÖΰȢzh-k~zhwl;#i7PbJP1Eꆅg8/r(mGToO{ߑTS: 5Źgu}ձs#N:n[B-K/ާg9P~y1!hʒiۜ^%XqM}~9@dX">qȀ7c$'XEė/dY]^KgFLM7`Y7lӗ7C (2 6o]| 0f¥sS0̘*rc+ F1mfX}& ٍ jL6ߙ 5E%?}GP"{g֚Ej˴tvp}Ry-}x{t$A T1~mg*oc"CxYQ`ӣ建Oyf@ҔgAFg@QEu$ ^%ׇxFB,1qK5rـ3zI"{`'J;u$f>lA߶^xګF}u}lUGW߷l6&E`[4ߑ+B.L0HZH|Cpx7aoVPSݑ<=)ݢ:iiݶ(Hє iHCi@]g$޻AvŒ/чȲeSk'NGV~WDDiW4OvXf#>#qʻgs:j?۠& ⛜9h{:HкyI-;@R˅3gZ _t"M`6Ȯt/{)&9v2=6Х޿KSCDe@R0 =P+zmӶ[[/#W+\;뉮 }H CWq c/>qK WGq?\>tww߷#lbW: +DMIŊ%Qk,[h &# [C8t0`zjP24 X5OZl2H—&6!GUۘhDB_j:ޱFgW %.Ņ{ *Q]=H?J񳁛rϸu߾3#- n!L!q|,mc9AiwL\I-y^dj-|Ή->,a> H#alcײ]M2ŬO&IYǓ= V@^yG=o{7 g];W͊ԡӒgݝӇ#Nk}8{y0ܴAh"8쀗"7q@EH:q)7Brڏg/p^Md+TNfV4Et鸿4x_8> (M bF^/;jz&:&۰uvE[mvu<blb- ],lNuʊ1T^YǿBl LRеT8,o4=}7z?<ئ ]XF1qI,HipXMj4g~m?C~퇑~P8h%S}$^gmȁ@%+6/>Qs>1\okC8%b&9B"@8ۜv="f)8^ڄ/| Ϩm;BUj6"q T@L6] nL@Y1\`TC\#Y>-7. '~m"u6+|ܥ")㷣#tA݋rl8fN !NΕqH^kf~eQ_]y3`3-m`a76װ+l[r'1$~/bB%i_}܉vup.1)\.@ <eIMńm '[&4 ]b, L(FM^N&4`c]~'^r^X pЛ4cfiL}&qC̹JYp(FJt"0A0Y$qJvRN;(  .&j,2cR 2L4X`P4kDPN$q N-X?>措Nt4I*Y%x<}ߟdWq\16ԇcdǜژ;J,S*9ت!H!*>Fk)b-QUľnԫgfy{>n7&=tzsxS/*jN 2Yoņ}xcj{`i c:x1MO\m4ߘHW{:6-|;^/w& (E`jYC */ +Jh2JLP`ϚPP#%tJʄmsJw. @!_ȒT̥ ܰWƼĶ㽼8)Gغ;,)0Zya*&ފNFt)uo'`b@8Z@[>1`E@.: MG^e j+NAakAO($͑'^ *ax U/B괠; d'Gxw9:Reu >xE/dh12`0w lcM0b9Ľ k][7y:$4 \˕H:Ǜh!|q829;&.hǩjKL{KLW: ˬɌ83?Guү={`5Ӛ@ Q{ڗxF5|׍4 sA^f\>?0'"Ś'޴`ՠɻ?R3N|-^|!qTB䨖[jtY4Om. ݏ_]م/qO: ֧)qGj4K*oIJlb \D6Z14[g٧;i;¢Q*V0ebKXF՝4PBi)Ң\~ה J*xj `}MfQ"hWz 2ȑd0D'#m Db%bPcR6X*1V/=q5ߴN*^em[ <-|[rm)%jJTI[.rar>?0vN/Z4MQWTN…ɇ淖6ȋb`!Af#.xw-X'&L,eKS.}9뵊TOn+vOǃʀ'UbI7Do89NߴrZD D։Ŵuy ].NP-%|=wR/LP6c5؛/ێ˔'UȂ H#7%t 7D>ڪmz6E_&NT%t` oXsL+n#EMm 3Gv58~4IbH_o~,lgNJ4ܠ[ֽAIk8et -]긋LXx5Y6dn\6m?p MjlzEtte4[HّSx =}qt],X4zx0ono3$ Zۈ#.}ޭfݻ 0'76t`rQ6h/_A(0[BȾ&/ ftXSp/;2 I%A+ MHWK=nB5_\)qC2⚲ HY-ص,CЇ4XXVћ %\7'\*؈t8{OQ`/C+}1.VQUlk]I9[0sý5К$οɃ2D.h3 =D0x@$n岳_,2PL&~&ו&{DFys``6 d?=[q70nT_R^B#Fi COHDD3&p#D~}dj'VZGqtU7qUo/q.A|p$$D,BlI԰:A xwp9(hB,IE▓] ͹_:A'ykݹ%#O {,bcx V,;To$Эp $H$J6s;UBZ8VRHwpOh2X~t#)B:1n"Jm6аkI؍3M&jCc9 U FpP0$&;?%CwYV+8ŭvѤQ-Bp)4VM*GS]IwP\J8 v Z̑?!O]mU5E6yq: eELَd TofX5,k r$:~ie W]Wڷ1acLON_4[#P/_y~U@_gW/W:<'/}"Ҁ?/5ݖh Fpq0䠼ŶCD 6=\jMs7&q(ѶH([3b I S@,;RhЖ!wh$"TK5'!1%;D}+<[;FTiyv#+Ai?9_siʇ,!G,G0 +++?A v6P_0~h,Uvfx%?31`WТ] ΥNBpF!{|xV%'12}zUAe“'0"7j$ԷNƻ/b z3KPN/L=%FO 皁#/]Y-B)?ko/>k>;b1{FLm ̀ċlH)Ԃ 8gwšz_9E$a#0كx Jjp(D:yJ+X3R,4SF4'A)ӥ@ߠ8_?~ #CmPLQZAb<kJĉl-B{$]ixY$f jH`)VZ*Mq#FԱ,1qK5M'pJYξjCL/DZwrn;v*tc+# d4S^嗻z/_///gf&dx _%)I6e__DK-hs=Nw=),_uyi$Qc F c- 7qX*_$VD}&!ݞj_cWe,\}2unʁt.J%KA2CX $-65em$'Yq+N4%Qa~W%b0sPnRyO9Bs!Ib$NdrX-$kCLSq^%l'No }J6Y0qZ)[ q?Sl[+';mX{j'Ek j|h>/ZTڲmMtTQvDѱg`ӞrA E0,iQйFUop#߬9Z6xrqYj8 3;]@T[Je 0$@]y#X¤Xr^ &dh 5bqgs`1int<>uVЊB%ݎ[zA[]/QQ0a2/?.˷~ t,m[6Favx4;)1FGd+x|6K|bdc9I#])C>pDگZ2v!{X%\-c T6S,g$(Ғ<1t\P?znMbL1nI=~yXh("=t.}Ӈ|=Tmiqn7u (|wl4QSpPZg+zJx޳=8\9c^m)+T\΃sH]^f5IeJ3 -,`F5&B4aaƭzEFXkHf^ηeftk&Kt! 愌 dsqkړ9Ap=_![sdR)lX/O.G'f]L4oҏ&/y5(YȽiouLn<!޲S;%N2bbOs&ȱkF~GAa9XC >dw~PTtb ,aYY0"+x L/[vܦ%Q0@]ǚ"A9YEI} HwowO [ |,^U vW:F{!_p#fWo0´@/உ| cI6 H%9VQ4!OЪ%Pky3`./%k 'DL66c$Ҹqt"`d. E~9f$ep%c6v* &53ٽ1SU⤢bem,_7O&#&͍ `_ĸ@": W`m\;xgf_Bn&vqIx3&oyV28*]m2Dbxq<^6jGIczIzxrvs?wf `{<5s#y 8LLX9^qf|MJ4J73վ]#TbycQCB5.xǢm^0P+$z`@l^A[P?$"7`fYew{`#Byh7ژoy .lk"ܓ8Lrb im$TI5E6{Uie>L,#B |ibE"xVm5%vڲl;6-J h,7CТi+a"/,U%ܾ>v+BRڢˌ(nS#{+d*HN׬\#\7H U/ӀeLds∁'k>S'ÙY7Dnˑ>blkU Qal ͲVߌͱA |sܫIǗD|uP''JGʋhX}ڪn ɚՄYli@e`6@8l2:5mJNnz=C = @w|,cfau2Be_he_y+D7g# 0(a{#mXe6~xv-kt+&<2V䆯M;L Eùrxr|p8"TFvղ)%^XNKAQBTeu0JdCID/; T눯@PhTBƳر I8ħ\2p/4GW_SU *d(} Û"2-lĈg(,y̩ )%a6C HlPָK_x@qLY?Af{5$ƾaAxZco$Wcؚ¸@ObIPr%lO3\ЎȊD59 cL&.>HDK[i". oÞ=Jl_tW jHKgĩȧu(<>\$7x#J;A`-b [9vX_~= xt.EE_`C\6:MG-M6$SqZȗaؓ7 KiIΐS~Lk=gnA8^2G_ 9h.rcSi h=#6u-d:ao*gѪ%cO-ʽKa8s? )Eha%f,c/ee{xfa{?+T ɘ BջxWW|(&EL >H<E0.툦 `=:x +h>%Xf-@t2Vˇ0DmD} `%IB(V3n-{i$>94l6c16" `p1Yk`Pg& Vflef3L3LpFPH,C! p _/ǐkr_'0~ ׍=,lRG˚ʫ4rXbƾX[-%Dۚ `0 A wxb',aܩQ/dZءⅉIڪ,cԃ5쥲TЕ*NoZ`_7 I Ὗ7\E 0}݌ѐZP8Qu dep,tv}RٞxP7E  i yġ# r2+}Wzq__WWkc&,[it1HIK [Lkâ&DB _Վ2jWj!ncwwK,xb~̪k;6tt*UiXL|ndVȵ(3VS$:: 0bA$zw$tyI 7ahEB'11cfH3$Gd[ KnI_UURiq{ٻ5JV[3\n]?]qtiq ;Q3|MͩLzb,$gg0 Hy٘z,9fe8eB m0v NL3x.ŞaI$Et.*fzTR^QmkfpD"(gV =Fߨ‚trvsY>$xf9tIYF v]\A`zNbWb`&ǘLNClMeN 6!*6|#E6sZSؔNE WϦ܆Ēyڍ {Mho~i870g[ԆϗU..A?8aY6Y O*z6 -=SU:7HЛm ?ou1 tEթV 6kq]R$dys"D'SxU^Y또̀:S=a/͛T\o!- S9*EM~HᄖfD@D05+;ٿyMʘxaO>cbk BZ8īE~2?'%Km{rzVh ?urwY8?:7i:{_m8(u8X98xq{w/ |~=ۭ0 !2;{TiNM/m:](l3PG}!A:ܩX-i|V4{Ob~>:Eئ-r3sjw"tnUxe,2Gso?!nJ- l&Li=@E5b !3Wt:@HGDBc,##ޓ02(>p|G=[NftO\KQ*eڭ]dw) ?_)_N u qzGIfb ;~Sw`3~E-&1^@Q@x3ң*ƯB Q>o{vc8~>6@yN!EomǃPEi4)EyO(Lj#c0%8ư!<{sa`[Bo4#)pT 'Gz 5VW` :ׯ_U&N7f :fW*)8^/I3$*@B5څJ `;&$4Sqjeh~ )Dk/mP~%638^ SVGN \;mug{:[jh߻fۺ7zkܷLV2{S#6{ls^K@X0 $vG#3V>G(Ac~aqqq JK++0Lap;Crlҝ%nu/keppe:r~.řŐGC `4C|E!R61ی\1:63=mo2-Nu]CS Cn gs8 ՍzJ ɱ7_f.$Lqqo(Wx!N0#֧ ׶y"ܲɚN_V P~w񠝦:]%abʙw%a|0@?7+ 885| . =|Դ1 j L P )eyL[ă9YBX? 4R3vkK9?CդGÇz;B+ SoJjXAc}+e2O|Ţ^y.7M$QY˸%]?ʠ'rm<}<3" N1]3l lC +$p/{zW܆*(mW \ u: O@?߷ca`/h3BaJ%  +OE\O inG__k3_9@*J *(Ǯ˱k; (Y,EM~O? ܪKQV (G%|˭B,"mXmffH/ڄzUS˶ʁ{{W[[W[[D9L7I&.z}4_#G?DOslpsCfTq`N’cU tLX'Rߩ=+&q6CTa}nP, ɛrÑ,KcA}#(llc&2wR,: lTUaO&dPini yYg?Pbg+( gq¯MȨ8ILvY:-ߊg34*<n.ܦs咿Oۛ'͉Kkj9߱O& btf $Mhv:=?x< k/%`mYBfܚ6x+پK*_-M~0ߜ_ISm(}k5[oivW?J8v4oM{uxc\ݦ{:|XNLCIH>=E!(HʔWUMQh|jL8Ȓ$BZ2֚zpA3*m=yCϘ{jJpd-("WƏվqp7OonH<.?}l86}uU\?\W6}c~p{XhxeoEJAZH<[˥OPsҦ庠h#;(?ȫs%}f~ 03J y0SIm"0_(#kwSSv/OGa (.gA)(g3] N/mСE _ 48ì_<}p<dڔyWkE-ٴ暣:VdtzZ;ؓ :E |{ZZ 4蟕EfBDG+zFhIG-Re@ywz;DxIYt?xZ_یk4~`zyŻ9)x𽈩)js#gl0?rzh sR6q%On$ moW8Q2ED'S6(9ڢyE)PJJS.Z-H|Piz繻 #20bkӹk۰acU;'U)>ܣ#]ݚ2,ZCL3ެzF=,!j?Ѿ1>o|iM]n])^d`_]*( A Hr;}&wijZ9ܻSvQ->s.YvW^TDǭoZN@iHzcs+ J!]aT!YFouڠa;]e}w@6ɺ{X^w$ʔC<䈞IP*nc .}q]nkEWdZkK':r>P$V6]Dl+&}T32aճ/"2s|kRJB rSqQ?O d 1=:fp\@P&+QdyD9Ňcg% git/ls< b K)uqpԙ^o\-L~ۺ,8 ˱8.#_럽.V^l|S gDv*[{'@P[(&FG!D^JbPqdk{'=OBnW a>k|u0ֲ1IfSf1 ;rn3(mJ>A`2+$W zu@gf<8tF| ﶨt1Ɇ7C~eп ELJ ڲ!{1~#Owf`ZOqifj%0|>J3=|x,E/8sm U,.2\MKېJC+(9-i)n #"C| ̉w7 K^H{P%]%aU6%`N=xoAnl>CwQNbʭ?z_(~-qy"՟N%볡/ؽ#&d6"$Mݜ76tt0ӓײNؔ$ 5XPN9/XUln8q̙)y<^vMkm+Ih#^3BFZRa>~տt\L&W Z"(0]:1{my /3OFi՜L_}mփ~W%Q:*1n+m<,nHہp-O17WkлZM<8;jtW$YƤgd>Saԍ&9n̻0E3aSVlYԐPY#W6]h AI9\x*x _ G R =PB/Do[Mޮ=R.hB,瞹c𦟕mr3mRRqz{^E~R:Ĵʹg=_צ^Hg tb!Q+zTN(y#gtzvl` (R Ig6-&795݅{9uLVrB$ewokg|}H@Ȏk> mJ)"7]&euw3r\6Ѷ`?G5kax7{yf38m뷇 ,6Rpxw\8~r晨OO.výcl}//(<4.lJ?~@JAZEsu|2x]w @ ~t;Ri9Ve JG8.CRhҞSk쬮vu5a/(,q\NtGoVT;QOn R o2g@83wMHӣ a^ D[>4Tw%qu:9𰞓cCEt2àgփˎ[s*<٪C%L:E_sӳcӉpO-zZ|dRJ?k\Jn} /BD>nt*% ^Y9@M4jf.O 7%RIL9VP~H!=zJuG4a݀ t޵ֿ&<P,#=J\c?LZG9ug,91v s:}CZ#C VzoN.&?k!eTs'hc3VXV1m&Q <0Z~OR8e ] ʋ)]hoS(7gC||7(ErJ[̺+#| zИrof3۵ W`6yff'ك6yY#O`ZNcLl|iY@=т^+N 9,1&rTt=$@BWR|23cOK G?&6(܉?y LD=GFhey7[.]~qg?[t4MN_i BRÀbHolxhҟj4_Y6c juԔX^bCGw0A>Ta *N]}߸nXmNӣ|&1<ޖ. };Z VVrLl"[[pz ~\QBIGAVb/za)'lJ0xY亍+Z Uq+NK/¼HKta+8ͰC}"KMJ@AEIfH=J\ۆX6$yV l4#M0L%cXP~%] ]Ӧr3st <5txnT=*9tayS.AQ#IsYXH@kPO>Em_*RXcEf'Vc\(0,ny>8İ.ytm#-ZO] }^>k.tp<1Y,s\bt#/$mZ<`&tݖGߡt=iG@ ڻ~oüx覝q1uz^ZZY('!roMݒIe4 W]0glJ^+ jR8qFNU{.Y V4 ) W e`;BU3%xqn߄K$@x}W$9d?al)Z'ѷMuVfGp=FT&%O?fوU)Q= [ʨi̜rw  ayA\D]i}Gke0^ x6^] K B*pDc9lReVMhbju:ŻAJET+I`./ ;} PuQ*ⵏZ&g]qazfյ$JXEw$Ʃ v}K޷:_=%GuICf|$#K:ܥ tV %$UɦșWx{(MOV M*r_̶ %vl(1Ŝ7Hv\c>pUǩ}zѺ=o_5zot%^==;V> xP`:uVNr1+5F.SeH"I#ˑo$AoMmMbt~A- ]_@g±e7})R\ dD9qLYB~_{Yq_<9G@~BSB@U)khdDNc3Z_6[pb[(D M&nܦAI%RJ_~Sd.*){/iT |q&9@9Ha"C r%,*aZnlxMbҝD\9U W8W3/6J'#}r;WY{R>6~do-t}K%IEXcOB0&6`TC>3g⾝QRܤsŒV NYwan#wSIB>n <;jbFN++ ,#p䣷?rswSke -6 dِY,AF4_`F R&cm$+ \V>YaTIWwOjjiF:mw H@ew!dzҭ]p׏5~zЮQ TBn g}v 2p F\z蕪;KnרJX&H)ZG|R?.~ ..҆Omi   k?cihAGްl1}ݣǞynXYY>!W;5*X3 TX{{UˬG::}«ȡe.5tOtK<=ms7:ex7ZDg=#7%j??;Q3{hΙ|up8,3ӫ1GM,- &8% _,PM< Rm,QXVLâ*{^dG }k0l `aȣlXCkrINBܯ. --;F! i593k2Le ㎂v+8 nfͮa֥DzB%#-0{3{+}q2-0 #)2)!pQ.ms:eWΦo0f?!sT>v\Ϭ< 57!.wv^τz3z\K!)"op|KIKozt6tGH(jQ{__H K OgO䲷|vKg7 S2<=Y2K'K'4K~=_E09AѝG-TQ2Q3vT(Í1HĨZnPa7pn. 3!..rFXlvLտꯍZ+x~q]eO 1s@gGwtCNތt@ O#TOd*Rܫcr4uCD &  Eiٯ%m&]1G]_Z ?#A%-Ӈ|~J%ýݽ\:Y 6aV=JZRD0OYLoX,o>?|9Zqm|#q57Gߊw4즵]1nlI'odjdt=0LAR?Wb bCd9pHN0艴ו!${ h;Jo\,2pϏq`׫~S;[Vo4: Zu^I14%0JWwCN}+1ACsh: f5/ 9[OZ(EBx!|()#p:d9WܰC7Ag Y<(4$uĠ K?ğu<2qLze#=/*{[˳4bZǢ8?*a} t$A2j+όeQ8Wս&K=dGpCG8@fv5AC Za| G:9AOp! s[-B?2 ( UR U~ m~a}$RN+yXCM{zf p f|Riae Ѳ@]iuY .wŧ~+ +ިiױAT:'CTG5=;n+=G7\uJRi^X ބM/\ BL֪$@Zt^ZVPQ_1̛N@\'Al^EiY3]>@ qۂv-{+ L~YG-v=֗⺺oY8 KKJL >K BBH6 o_\!7L >90jR"9G{mk(ݲL6s{{:>q7PpT2P'ڴusd}֐njõ 20mvz`\^$zlmaό w1vf߇6A `f@7,?mzL~DK22# ҝGDHz3?fps]F#r9Bx@7[^Jc j'9@NOURGT oP/Ћ0F4B!&)gRr ~0Dćǁܞ!YR)%+\K8( _feG{lǣ5_BM S}L&xRn,ĐD=~u19h] ŮsRc;MHA83 Tp\N%kRRH:n𱥇ce]pY.RG>Ԙ :[=d\W=,K<BB)LOr$3=fr̎=Ъi ,EVM;Iڳ)anR-  `qʐ'~T^y,wsEfLx).*\("sP$%< &(ˬgLk4"a(Wɗ}8u jϴ: ѽ%]+&PvN/.nLLܘ1#%l1?7A1,4C-wrlaPVWr#+B8 -KG!6ˀd?aAD=nQ]̐\boqfο~F/ݓVVqtʞbiY2hMm7y@|ٿ}A]ESZyuBbgdtg9#{l.H0&%me(;tA2u4i`C%H[d5k3k_br0hΕՎ&[2f[-'tn¶f9 G0,1OOSf!UP JVx/Y 4Vc0$QEr0A gJS@$=U4CiHI^| Jؿe2mR"tAZypm: El6nI麤#!q|UgK&'NyɳI 4}HL1I{I? CS#` DoO(1[\tLұ.])@.h'3\2l1}|7 ՘ PWbu<~u7I&}WC1?&-)$m:v ]H0@Q^K=7$~ħٓNLtOu!>{6>|c!S^DiϺ=V^:|hKMiEh0+LxE4AM ڃ`;:#]ob0.pM 4ǎah34f/txA?QLjڻ8t3sA|16VDmbh{Îrh>D} -&vÂiX\rIۂaY`\'D;]-CL'Y!j{oh.0]쉿!uϥp4|6&1]̿ 1h fĔZ<]@<#G-r:Չl |%hpt8D}\0q>b`82qiɩC>qÞ7ЍP;& m|FO| vl˂g|,]a/җ ip bOpk zE E e 9ky2ż;t46CMDI"m], L\Oyl?l1YQR͉ր|>^D> EE qDJ#AaP8w[ǧC?B:cj:Re0P!|?λ6>ҡi]:Wl;oS-!tM cG{Ķ+&iW귮X\=!K .ޞqeO;4(Sɋ֊a4z^g^t~Br7]lRg˰Ǜ`Krjph/ 6fJ3b3 @ {>#E[͆s ty7O[I=RSŔWA>Υ> :gK\ˉbx)(P[[,K >oJjrJ2z 4Al&Y~'V6LqLa͔+۞z9vfV fFU=ƜAwH0YrY5HjC U!k=aIN643'!J.d+-߳Y,tIwA "#0DrC9ߡ~#8 !h«Pgf։WVdGalL,|7}`ƯD \Xpd2/Ä:2=ީD\t͒[9D2N|l&Lݑ3Tvlk n9%.ƩᨔƙTղw$%]S_ mxdLv[ћ>Nn8%S]X5kDg ډJhj=Wm4](hj^ )8@+8l'bL)!L%Rh#\g1Fv!F"x,GФW;tGS0}C(OT=paTP]x" k-knX`%#A8^0vV#O{) ?F>oD\F.? F1?JFݝ_jҘZ1m:_pryV=9?vɰWjXNos8_Z\Ua֪|iso%`W_'m[i'yu;yغjyhONYBc{:ss|r&}'VEkͣ~7'OWǭpy_2B[Z@uounBpԅ[jlֿqPO?hS\Y ~ސųˇǓ{*8⤲9O.Pji7dH ?w7J-X jj;& L嫿>MB2I7!/ԉ 0 $ 's"v{d6+X魍)VaZHT:"t #4|6fHXKypdr,ָG! ka,z*ncźپ( K 2MhYBjJ{D7g-*3? LLWHH |H糔k<&`r3z{bGr3{8KXf>Š7F \6CEtuEa6>@`B^F D񅁮l yaχ"n8 2c]+P%>OkATCSyQO]$.nG q`y DzZTm9K`~3a;]=ƤEKarwKϢR!r6.Wyɼb {[4̇ac1$ {\X@qYD2WBmb"xj+I'xnVF4`h塰(8-Hg{6YI3afWp>̒ Z_0ꓔܛ( 4Yn5II[@?9YafƤo~ekdI;t]l! L|&!Ц_AweryC4*JwdLbM4dg &Sę8%[mX#LwN2I$;8:΍$P!/1،LH/j5%, ;{p~N霆 ɛGAID *}Ŗ7omRW¯HQOC=, _7kLH:a1N`8ko3z횠eaYU*v}wzߝU*wN2I]eN);{WY,U}wzߝU*wN2I]eN);{WY,U}wzߝU*wN2I]eN);{WYTYn֤7`@O6DUAG)1Z׿9#0P ej@uo͠z ,^]/N2I;| );{pzwWwRǷt HaYy/<~p߷ h~a6 ?xW9?rx'y$佫 );zP"._Iw5ٖ1z]wiRz'Y$dGHֻ]K%J&t^:YnjC,mk+jsVSbҽ&[iЄt=0!ݝ+U: AhLepSMW&m]dGЄp lO:o'* j7C<9h"ɠNw6#u<{w};yN޷vNߩ;cԀkȇ- =>~vu4- v^%WɅ* q,B~~/m:_VafX5+|7z]mjytP{M600[7 :\SǺޏd;:p L j$R]*>nu ;twu bRU~mud.~,/p6Д־>M;rb0__믃Z5sUm@" FZZ/%0=p.CUjqgnwL u$rn@aZG_z]ЄQ(]wScLOa e0okn\i^s7zkYH7%NDKG񘜎̿&ۡ?=C=P=^<~c~snNVHd۝g3=X-5O?oj7K?篟cK915`V}tmrpj/[Nľއ>y]{s|O]38ǧHO)M[ႝX͇atMMe0γ%uY= ``/j߳vu\P`3/$E+b۱~bD;e s n}3H$5UNA\xY+nn4GwGXuc_ѐ&[m?[N˦1u[ĀGB؅5654uk?,VbIӀoM$JSUh P˴gU'+?D x,6ѓ$n:׍|}mnj3 eMkye_Ԡ`inM0I8t 27S4i#[wڌ>ݴ}/!xനx[Li4epEwBF !epdq@|U:!GTz ?Ɩ.QO;M8/=ZH"M += U]P:QLs\Fznxf+)s"aʠ gnf.Ȕi)Zn11`$4.pL vP(vo7g2oC6.}[]FnP`^JLGULt0aYpmju44>0v" S_L%|5#7LfPty! Uޠ̉'ԑi.?dA?[֢*1dŤF_g dLhOHG8I t*!maoOEu3e&nl]\1HPUV{nd?`C{[=[-`+ScKِm%cm}R2NG!~p|u\{ԭl_cly> rvs<8Td=?#3kkܲUo-nO]e0˙$MiM]uW Rv(Oƭ u6pYAncСfzhruGyKL!`\Of ^BnWlD49ےXu?tI?mnؐX^ Ѷ뉊 EZ"G z 6UZ- ,҃| `=d[Gկt'G[+c6 6a`߄"td ݷCnإ}uY t)@%s]&M㹄W [HTO\5X v:Ad=3Ӝc."$^LD] :[t"xրͷ&.p+Vu5O[. ,a~Vb]F UjU^5ل`'MFFNb uH\S>X>%=gܩf\n=t:F-㚖q ypwUGn; NOr :BHחZy!͛>p}<TAhi92 )-P_;-ðiT,1=ncMYw\CGr4q)9V3]3-'n[#ggAEQ=P~Y-Faògrb5=w[6}¤l6m){SrBcNٱM!'ӻ㳳d蘜hPn&L~1 sf?@#׺}CZzVJG;POeu yH666&K6^P''''|͇fAڃ]ױȎwNMv-WJQ+_56_&xVeds6K;/6n0kaU$We63[yGw|QNvC_a1$.eaR'p MX7_R&O=2ʃBn %X3uz3RC6ˡ<}QE CᢎVƙ{_oxj0:E1$߸+R$`gB|Ѿўݿ=^ ?ooMUծPi"]hʕtBF]T)~3E-7M:$91xvCbt8[zE=Mem/Lh ͹>LP g2^/OU__,hҦYCzW@@zW'5.#2Q,(톁82ʛOϨ^~ެQܯ7 /Ў[$mt*<'$vknzTn|~Dm`ed$Kh۾ZNtLzd:i%$I)]7㯿O/ Ճ7;oÇerۥv/E>4cp\,;5WUeޏ˽+xgi,ÿig8SfD>vM;p]OMORQK_ʐ21^){1UV)WܠX /ӣ"ͧ_KD 1U[f')#L cJ?Rz yAPzpER,Ld29 ; d.l`kʠ"S2b%YO7K֑~mJGz_KmpUT6PV+[n\GE9ZO`;(XV.4=}`MHfb͙>N-wn꯭-*6x( ~6ܯ(ZlhtY4ʪskɕzmvG"ޕWRˤP"d+QKzN Ѝf0ɽm԰QKo%/nsևrڷ7Kooo=-a6_Bn%t?*ne;s k?NOIfOd7 ȲnMpd ehV󙹑-sEM 6=%R;#m=; E%V0_-֢vOtGSѕn 1ff3wΎNÅ rn9lxlvcA VM`Ih%>dZ=OtO?vd`0OY٬V ih6Srm[ٴ .%[IYcV3GDѷ@CAtj S"ɳ2P 'g[Ev5hf@~Էm}ݴMC}Ĉl}ˡU<<(gWrW:$ Vz3Hp  ri~~mJt_)Q${E}CuuKn3Er_󬥧3BK̄xSY{=1vz) _zz=q=Sp7[HV=K9Hx7U;۹lFٿ8;Q vfUo\R_"e^/ Nk9e2L35^oZjzh@X sQQ֜IPψs ڬbFOLʕ)) XyQvԒ"sPwq757R? %C-7$3debgƑc+]*^(tQV pv`oH d>^G\8|n}_?OfgaD=!b(\;pP(|!XUaF^jHm'Y%|1J@WoN\l(c}UۈmvqOlutݙz?LP$ܾK; hV#>_Sp3ZߡwB\.D3lK5-? !Oj\:=V8%˔ 8e3]*Mʼn( XiJIqy,-zDV"=(EJ拫Y-%z}aПR<-V,' X\$P:WJzL9 a.ի/]+(oƷ?9.w9?Wv/h/˽dOe#56~_ ,8O6YI F[{<ط\AhJ5٭̹/UX? .~ SƎf ؆2eaZe(/ѻW#&PszjP~ׇ4ۨlYSFƼwn{6h ~6i:vv}bu'AII7=U48B';%%:ju9t4Ȅ00'4m\ 7`i!ʆ4 8sӌF^VhlۀM{:e)~h|.:t"S%w*E㜒FH-̐Wgx Dpm1e}2I:5ֳ[(mܾZ6| Sw&9@ђx@Ё{9 (  >!VCT3)Eizz1Yt/4:K+M4$Iڳ\0@sh_' ]bZuc 6?"Pneo*_Iو_j9 yWEqfKOuWZK#mذSlX71: ;pHX1r!k)$b&sTBw$*rFYb476's")\³ ~j.3+"zx)㟍KNG_(b`[ O[{_5<-o_Pm$Y*ŚRz\ UxT鷁zE/훏~1K ,1Ʒd3M#_ފ̠)kV~>n˴IDcH"麹uv)7,*e͕X>!e?TEQCa iY[tzans%=xzeƱcyFQϯ4M^=X;t l9m ~rd)yX !!Շ$͡LK[V@ah0rvRh&j\R"i%}ģMN,tNo(AƩ>Vi t||9 ՑP\^|GEQYm ~|H`]<>[~h6 -ή1Ȏ_L!W)}O1 *uJH `궉΃X:žR@TiZxh[:-}H(E<9V%0+, T7`ʛ50y㰞-Ex*%$Y7-zb+q+9[{Hpk&ԐsZ"HY9kjȵ L8#/}dט9qCCnʗX-T8EI1̈xz79?E8@S%hɑZre56Nq6w--?T*?\2HW燫&qrCEqR+ Y.ZXd,=v+_Ksз K>i P4~#hӦN>67")!Lrt=-'-)?N]@$NƤ}U w9ʐ_T5q\W./@JIqdM1OJziuMPܤ) šڿ>2̓sr@ 9C`s,ߡDH<7 k=J)*H!` ~ͦeJp_s$%K{}12vk9%bH3PL$>!_<P"TnT-z)r Xlfx Xp)5ߣ; !Lֻiclܺژm J\· OFnMECOn #h=& <|4L`Q P:h-ӵRӱr; x.P]יr2<+P"哕(*!2xJ~z;h|pKvCs^rN6^!ҁ~_1) \m]f޻:EQA|܄ɭ / %(ޝD_d>MCN7|ճk!VBS3QIsMk^_A 1RFFQ*4Qґfmo:b0k cE w Tٸn݋ h]`.x FAP)UEiTb+6JFR;=T-*P:1O9C7|eOYuҭ%P䵏k2$i@H2qO+dcP*"W//Ff߳"tCk~YdF(]EKF:SȠch/" 6Wt|X^*4k!iat$9|Qy b__!3䫑T4тykb۫>T3xi`lv$Aa%r&Ն/|v}9q1Su|?70!% DUq|/D/%M/?%aBiDu崸)IHqt]/iyLHK@P \'T,ld~qvv9 &'];+gŖbF( eB k$O(TI\PݞВOuN=-),\5.vWCF/CK_Mĝ)C/QԦl@׬/hF׷|oK 8IkYU=A01a3RL8E$w ijI%ݎآ:s@A'a#e?pNo]Fjo %(6s~χE*pl6TQU99[>CҾRI)y7Ay` Q!*"P h_09jRܘ @l+aۥyۦ??szM׶^rwj5* !FmeF *f #F9A#Hfy6Ô탙DTK,]@3JLXy=V`ڡ+$:&J1&0Sd : @wε~Ffsikty@^Ƅx-P{BeRmp 58I5TcҠ{hL@%'T#>r%AE?j:¼XwEʔqt|7QӀa9~/w1~ZKai}^]m;Ō+}a&mO4JuԱ 'G^Eu>v`W0-ᄔV) ϻ79ԅQIٰ7C*.e,SYj^>(-t"5c}GSa>MR1CH>_ cHB@6ʅ>캎L&aAwg :q9qg1? W9O?S}?w*Cr7+= l>ݸ:2<6̓' Qqr-UJș)7 )O/SQ:kyqertZF*_]dL+_<_|?:=`Q{2 b)":!YG[딘X}|OcWC_rzPN^.}0vFL}ޕ *j+?aG` wr)A}tYz|U%9r*۞K5W?x}_'KތhlL3怷fF߆072-{%vVZ,g~.{GS,Lyu\mw Cڇ }ݯ?q0G;ZXgh,sT4}~TA :S?6(ܰLӣSÖpp )24Aޤ7A1mQߝZe Kn jįб3b9c!0)c uX긩O$=589=a0*H&0} 9vDnTBdL(ݣ >6[chVH2fq&dgІ#Cl]aJw?+z(kyLF[Z,n]$Gç!ww_`|a0 U -nxw)3ews,T;QAG !yL~p"bUH_/r\ďO\{5Z}Yj Ϙ2 _g9c_9]cd \͇ "p*<[5 Ka $]*݋F>MD9JYqBqf׏cԢ=Jk9#(züu(kN@o!]bRC#zb971"7oZWX}Si*Rׇ,M]'=p]V4u29Kxyئ4 S=mxC 0IoL3L8Ii -f$pӖm"a1GV߶8C 3ɎI3e,kbMor;C٥^u_2s|V hF'ư(f3:^afU@w}&˅Mܯdav9f]P[Og#I%&x(J.*a:#Ӊ1 C#k (>b;cmB!HՀCzHT1jlJW,Z/"L1WFwM|"oFΕH")܋M!$F1T-'|'M$VA_>iV/BH(+Ħd>oڷV*l/9׃N6:&X3b֣ShKECن.^ ӐAx(I7Wu|V&/= ocʾ%ġ<Dd"> 8 #֠WU_18Mh}bhWk1-Be06M-]nfx#LꂅnkiҫHV H?2 )Bgu94&\fh t'вy<~UK)b-qB"a,УܦkJIz&qpEߞq+I݄obUcttwxq \`ZÉOSNҎZbZdk"2fXaʭ5x1ϿbL*YRUjK;'nt\'^>Q=Z"*,^&G7ctݿmN1i:>Y2},T1 ӟt %t%'&FVZIsR{QR+G U.7R\etD21L.HKST<;,hD18BBKOkt3]ڦ+M{Z S!*2 $T2+ FQ}U @2TִΙ1.Yf-DUlj >Fw4 )8`a|1bGړ-6gfxYzpB)Btbo[}؃G`٩v%w `@ <==sP\|~Bc2:;Bc}΅yoˣ툧 MhM)ٞ~&&JD9V~bǔs5fWTvŌg0cg!݃Nr%pm?8nFMy l5*a֨tT!ٓDgmĶ7IEmNU2ԆsZm?͝R dڮz>^)Iaq Oڧ8/9\WB.yMݤmA}2OwF,}ooV6 lŵ۲n%pHjq ? D;ǭ #iQ,d']v'`'͖-BLF" gB2Z;9/e@ʍ$ePInb{H02~.p Fi2rc+YwCѢTF94iQu+K:Fc?- npӧAcosGHb=3v7%pCBm 030ۛ;)qu9t ﬡaCp5h"$Y0`$PqzFf(:7WK?VDa!7O`vf+{Z]H{RaIتNJ- Q 6\b?ɒ2H|k,Ɣ)#XzSu T5 SuHӘ \1KY6(S &33+swR Ea,=(qjS/އo#-x( . 4211R$ЂFY'7^cM{QtƦT\?~:&A2`!m̤)%64;qMn6=0эe`w0ȀrNkO,"G^666'^-zj=)j^@0(ƛbOTsG>T @걹FfrŸ&\k,@òN`C)_&+v4`99K,OvY,=|KrۅB]\KF.n!`/'y%7W rSpT'J<7 QdR:?<,+qo'ܺ^N3 O~trvz6_Z+*~ w +*gu5e@Ž Ɂh cW.^T}U Oɓ:%{H*s@w:kB^wJNw6\}nGVl``Y`*[vo9_88.\Tώ 7 q#Mv"!*0<檉dڧbԺŗ+76P/RFtr|[;.N۶*JP{czMW# WF6Eʶ`If)x*;Bۥ 4}+3 ֬zEDVIu`6Ψ|ؔݔVvҗ/K`Ku=Gej&ӆ2wO6 ٕOoDj*S]0I1ql:0 a-ؚ\SSzv Sk>֖Vu j?q?Kd'C=td ( 3_ DIa+v.h}PӿL3[~(j.O_1aV:z T}bp"-ا! Ku>0P 3aTUɪ4]'kV9?_s ixOPC!l}t}zҼ%L+&~W]7ħ'滁\S95d)jG&NN9X O40b:[5=~AW.B*cXII0 Pq57. 1`Q"ȡ#C%t1=f<[.,j(2x,=r*.4 GØxՓWSz)v ^ |t*`ux>j0mXsYHA-!^$t$77R ._!t%jLfPu{$ B\x`qr)ebeKN9S45F!c!1njؔ 3x1ie+KRT:EZK4>hC} idx .0]G2MA/U&[S~B$#T)@Ǔz'(~ItJ5]e<2Ak490VgO`"id! #'>7r< #tKl9xeөyIN? bt {#cB։kNu65ÊqWGa"68ݟIq[ېPZw\P>B ޫ!,f=b$p'6&Ҫ|FmGԂ9r'9R ,RT:A9zV y/s[qQqfLdzoMd#B׳x\+Q1v:mK Lό=a1 ]Cu+ՌP?+S#Դ:KKLr |H>-mπ 1 vݧZqDIo w[ID 1@JHNr\x4L^o#YC6K~b2"S }&0Z|jn .X/a-)P %bC7śc@lٳ>(MTTvPPbԯrQ!2E?ljGēoprЖ i-%jDuW"+͌SanPyLBBc,Ց!n0~.t[q|~oK!'U-5 TRias~lڶ\//Bhgrr62?"e8 kfNlG;W{,bWcyPR:Kn @&:+|v"#A$Ɇ]"ˆ@`!o^HIM0q#Ssc<+Lt)J42SȈla9x+Ťx eŘgL>Gc8V-垗!B% -ܫ2l/ !dDg׈Q[ X ATڮ7Q/5`Qa++:|rL07|?z?Ե2ӓf FOxMiRYˮ %O$x>vW:,>p%3cK p<7coҌ : sk1ĩu>)]/tO03<ɱryS?fW?@ŕErD+ɫ FE4Dĩ@Kص۫CCYx0s+xJRYjܝkP0Uf Cs!XR6ls|y Td pq21gkX!)1!5S%$iikbIzf9G a Pb:Da:ݠٯ1enj_bc0f-*k^VNFrLRkf?%C%ZN繚DtkfISۄAFzܾg]T5x HpIg;Lh 4R=k7$=/W3YJwRTtk#m{9;oQMn!^vłF~L Ak嚦TD4jDpZ!^Ybqͭiq's],5 H:ɊhKP_DN)0yaEmho?5bӢNoTB< E>ZMr\z+4r[9/iPsTa> c Q^Wc$Bɺq )U*R=CIBmf3 m煾8sn5ϢyxD~{diβ8 c1; ^ 5\9NJMF⃄zc;I-$ɘl ,:CbFKІ>cpidDv ^e}!mi:iiҧҧOKV>->-§%zii'Pq l=Ż-zmo[瞉`3}+ kz%3M!>-Hn= h] lHc0" {ce_\.Pm~VpX;KUFaS~nL̮a_UөM/=}_WICuYD#OOD&$?g>G=q^-\C =Sb釘kk .,{e]l]‘F8YE9eef4Ҳ|ŋ3_Bn~XYIהmֵ4Q?:ܻ_on]A}P@x-O=Ȧ) ϶dIUUK{`>jeŽ+ʉHi:x#j`(XQR ) @6Ruho(/PǪytd/EH,ݛèqe1 ׹%"-};op聉8!\JdE<?pDz貖K$L7esψUMi<mWcT*Y@kXx:r]',DxvZED A$683-V?moLkqnяyYx+y{{K3 Nar چ`,C=Nܾk-" eQ5(4}%aRȃ"4UnͿZEj5"wyBR2 XuEw>$ITdop-bY,g ̜/oJ3g~Az+庁E-ɗDT8N!QErL"ɈH'K ŕ2It6bSqLh!؅| :fkitDL!^FIaqx#CDXyg,VGb HY+6n}qw,tPV?-{߆?<Øʼ|Y?wo_m PXfL#fBx9+Ztwz԰:AOAVy9lq*>d,Hc[2ݿڻjF` 7c_ܘ_ZX*./,-ϗtoT]GL K#Z BGˋR=R*+Ub6FfSJaxlB\"ӖlN-=M>[f$s@4H9o|4 a$RDAAͻD8tnx*b'9!jXcH-#cm[Z2P֝x]MX^Ψ* EWV}#-AwC uMk{,"9E.Sbo?[NfB8_d Ї@ [Wqw/j0v%)Jza(0>!bєt !e6]fD9j4,O?CEF[c uۃ~pcu4Ɣ!<x}nܔgs棖8o}ŤA r\2u X%va {݁ 1$iY͐ZDMn9ckK&%7x_' 1% p |i7@_6k#1-c1(s+KHl;E_-A~芴nk,J,8P(WIbk|Cڀ%I$/ Ó᪥8|xqȪ-MUPKfh?UmT0+%=}N_JzI9&Wr9MD4tN\$ԑr{3 K{m-ڻ_3pZyt <}; BhJƱ\2YȺy:{꤇6򨧯r6a h9G3-M ( g(Pa^ 89x!-GV"s{kq:B x*6料d]ecq#}?54BHJm9{ڸލ8JbK kI^&sO{uI $Y1N{ΎD_=[KCvyMšB|I+0"q;?8xJSwlٽCT:VoN^L$mKjhfa+r#bzT/q\Y-vb/<7ڟvu %%<ZaV1&g2š"K\B6L^hbgɼFEfe^-VjlT{ >UMf,w.p]mZ=EOi`jkHhb-(שciC0I 0pVm, wHP%\ 5|<}C?sJO>\0+#sTC >_]gk{}Cv9uv' hACv3ӡ@ OyԘlr@C7*t<h$^?O<-<)^xT"M-t\EPe&Zr+=T$zT]ZĎ<L+XU8#'wZ.Ai\C)L>F7W0_Fb#)@qw1*Ws;bӅT2G!}iX>e*?(Suŗsdx=IO>LʼM"^Mx<@}~+[$3\w()EGiBQ\В\8YCyD%)7Rڟ[ߧE/|%,;,mAY67;nN =<`ҐnqW&|p*1awc~9)Bs Ѿ1wGMgs'ݶi6=LK^߰I~ ?a|Ma[8TLٖ⯴Gy̧fQY2.uebjqS'drM. sR'(u?Ә%"{VX/_\ bYXT^T1#PW@Ó.H_P^ck6&cZ 5qr%CDRZm1iCTH 'VM/xjeށQs  !䌳7G9}ΞP Md&)Ybp[:8 _X`0ԡ+{ށƼ/[A{%%.[&((g90SR*{p2\RXB 6 ĴMǭ1˲1&,s3&[X:ƶ7285Cc8Ù}ݶ?3h|PA^i,etȦXf1*M+ j!iF+ V$.aI7DFh;ya+"6 qn0N_x&{5Sx8|T B [f r61,Ĵ`H[2yN4jW^޲ͰNKqa5ePoK^{qacIY6 1v1~iEv>f M16eI5tQJlXPd ,rMd3Q{4}D"}wv,]-[ mD <rbIh3# hR+ǃE5!|Ԡ[#_?p2w?{R{)wf׍"yL1:5+)TBH[|i#/aU_!zWVvICc4&+) W53шhmže)bṅ_ P=6EvQ NsLbXB0#3 e$"@՚Ԯ 7ŢBHMѢ8s,ʶ Fڻ2;S4+1t%nˤZ`>R,cb BܩKť.`AV xV EvM#xFJd魕Y*}YidA?a}r77r J!x(H9#;*D1TzW9 S cq8r$$ÔқFDK `S؟cƲ"r-єgcu\>S|~cCazA?z Sǵj2(zEv#iuDJXʔR. *?م(EUHH1ǭZN:2Khء*5ki&r\3H+ b.Z\EYxeHFGZz#669VZgyeg&G1VEfR;9HxE@F2"K|q@Y|?SV[ i4\zEF,eNcIC<4X2{XkWlt 7[uJ De! ;'GGoE'$60fNn,cD'd]83{$ʒ ͺP'jDCDྴU Zq  P=1!Ȗ6=Yg'̣eY?1UbOr}\a|˖|#@/S"=a2~~i9Ff1ז(2HfCw*G(9lW\N;js|sYXqDHw~mA&@[}_.fʪDf!گ"?Ԩ]47IITt:?>ڭb>eZ0l18:BN'O2,'D#tRP~H2#{|1 +rsD2~{=tJ]4:*LX <.4V }%ZAZExbî8n`iB0f˓cAEbFTMoPoؾ"w!-Ȋ6  cʶ- Yv-' [ ab!0vR՜JιyݽW0)uٌ9Fn l)fc0P-ם?*!avE*IYT~#B~QgEw ߶jYxU! IȆW:%[nL%)_NżG 75:ORm=|T*G'r c%%$}?5BxIJ NM\=X]0FDSӒhOfS)8)8j}ޮA멽Ѯ.$bo}CqX'#_GJv6O_|w# ,%$OiZ1 j9Bw)6vKt~qW}yjJ9,)"J-mv[ƺXVQ%@TL1 f&9X)/ӟ,a|~%Ѥ"/^կ%ƀM8g &8de$|C & U_%X4 =P>?=,A9U|jl";hʽd|!ė X a*9*Z-fmHc\dКKǤasLdT1wXJx/*4_/gy[ "D])vy6Ftŝ ]'m#ڎmHrSX?˸/m/¦W{Gi9X_'6aS- v|LGqN5 Xy fymBZe5qn#Twz2Hq;ɢOVIJ"CgH^tq!Dj0*/A5!ssKVx {6v,AK7oɜn=-{C#Kl tŀsK :c<i%gP%n;@n9L=8(˒u &ˮD &#֝2+~rhߑ5ǭ71@j;W Ol|␬ֶx$7ʲ}7O4`701Z<@fpTuߕ/x3pc83gƌKl9?hr*&E/ 쵗M\'3k fgB8ReIZ:V$E( -8\.)G`=π]FOwL'j~bm+H(eVXod7ҫ*(Mg EztJ/D@Dg*-x/5M鴯B_š&M+HD'E LPӟy~r|)G ԽϼNisG0 >u,) k֒{Iw W٘B@T:U~oHd'bhɿذQH=Э:|#!WDw G!+(Z3Yc\Vr Eb5 >O&GPU:et%@\ v& cL*uhR:x4 q$* e>r:2AY<ÌI@^H!06+UV">=7*3 ߋ^Jf^bI0rf[+${o"jqm I!sd6dQkЙW74Npj` 񘕮%oe*ҔȰT, d>K(3=3ω7c%WJ[Q( +Q|GP⮧0| -JPJ_NQ0O:RΧHzIs*ko0VkزZ;r>O܏x\V縚ĵ+~|VBe_]{xQbB/hRA}Y}a/  I zD"'g% 24YK]SQW*z|2E9?*rHü?$N@t2B]-* uz(4ss nTP1d%!.vo a1ڙ)<dF$AvbBVZkoE~N1AQfu>@C4%Kϣq7|G£8_Lǥ~`ɏ~8S[a9qrI6#(38v\=nzf+ecHr]K+%,Y|7K YjXR0lqWfǚp>ym8f =˪sK%C_F dqp -%$L #"őBLLJ|b3ݺs 254H\8XfC`^k1>&T1 ~ N}oUH!_gs;~mwktjs'Mg[9>`G{|uvS-eI] *ձ0 M)'2l]VOC$N;-λG::hG"(͝ԨR#&;G6U@lYzcLvm@}QcdSK)Cu:arP2k%3^]Exr mP#'(('lwj!X+1a2?"eUFRZXFa)!Ἵޓ3AC%OS(X|qvNQ(#"$[o@; q6 mIlxZYVwfb܎ɠG'Шl!uѐDdvZgޔثDCuãKۅ^f^YC N'(uE *M~ڸ^`9 MVʈFCEYP J)jl2!_ٴ?l߶F& P5xg\qiiiZ蓊jP*ԳSOw[V אbccYܽzHw4$nرIFn} )tG *@eGQ* 2jfR Z~X~*0AȪ͋*@n5';fRا:-$ Qc[BOs0Oy{v)WPpLF#i%2 ~܊rc|;YP/0bQF9ڄ#8sP)=qM=4U PCR*ҝ IVq&~AuY64W Q2Z ka(W&g3Qp"%&xM]vâVܶ5%BdǶ4%O,<:D|x:D7oFDi M z'>%ZںD(C(_,5 \.1`T/OkE X6-43x"6"/Ȥ5ۆ @""OE)q,\ O:VqKؿ٫(U Wೱ(yԌdku RΊ_!FYqtΏep5nԇ(hecCg.3 *I"躉fCOA+G*EJMe悛$ƽtx:|1st‡:WF,6on*eSS#@ⳓ4ı3g: *,N<*X}DJAmZܯ=?7SHG\}j N!z>\!oiD_P(`]Rzc`jTc`hT4֋yaY4NLӒFۉ8_(a@p?B( 6CwUhAT8*U0!Dž;$mgEQ,zk"ycm]3Fmp5km^[* ӝE@IּSdJ<k]92[ID5n6Q[FhPC2̟ *g$1Cܼqvua9S41V^A2B\d#iK>s|x Zoǚ=G5 &#߽:?>=ppw1= ȌGe ԐiO&aauD[hqmebU7(}IDf'?nMH Cp C/ kn'16wQ 2mcd!żta*}f֘\]uh-b5*n'&II 7 ^;&s?F. h:¡ΰ(-1rdj!SijlwX+>{p}Qp+92:IP(GQՇ Wa DUQ*x:='nBɾǩhS9zCAʏN{q{ks5./9p['gǵObu>=6WBJ|t[Ssm|ȟz7cA^*Vڷn58Ա {ï}ʟ䒆e臀@r^t &3L xYB@7`Thbb*xGUUbt|)u2[7H$ Xzc*G'BUHNj}5^LxS'ou^)";ىm='oR2OL«P=pJxsq=|H,AI-b P=8XBN 72@Ӧ%H)sJ/Ī g ^ !v/BExj, 7D!atd$XܠQ~ob<`g[ύ$1NNN9ԽV3>SzC K(VBF?z |ja{r&Wuvp1wjΗHiqaX/INNuP+{UD]G)?ZoVtuHuhos=UMl~q/Cm cv >$bXj%( tBpßAܵOjIϪk2K͍&0 cZ&$( )+ySc4 au{c#,htv3`Ug0g2h4VpF7:8{[kQxjٞNhdYg=~Kք7&RVR;.r*Û;7.3,IJ v!SH/wl|T;$M) i2HǖDS2~Ֆ]Sñ<&~ӳ& XgOϿX@!&AzdMmVѳunaN\= sPJ ^c\~CK5_>>VШ}|"{^S֦J-^u(R5RknOޮΏeϙET79]HVM%6љJgrx(d@:fұn [!ͫLJ:ex6 ВmX Ul4)zG g h@awjrk:rR7p;xC5n=*Bb{/w/f/3ԯP Uė rn0xݮ݌xwd>4a11]K1.i dܮ?C\"H l_} {7W=yg @A\7a8gXE+RJ0XW*10(]V&&|tDon PF}r;'|q$C~;c%t J(7'oh~( I ..˓kFN*f*љM/ ţ O5bULF>[|N5y`'`h5t-e +'t]d_7f’b /{{s'e=+A.;XX Dew6hz:|zp73U=F=C0[#ONS!̸ k?ztuU\[1>BaJ4 3פ҈y6*#`̐x]4ѩlLjhkZ?sV&([6?aqڰ?wLMh(MCZvB?}o|:)Cx$mom$@C4-t^տ,<-]UJ^7(<^77L#d5&R+%޻ PAd+/"I`'?+vL(*@3IEUyf;tŦjtT ^ldYoW?BL-`%&b'Ŭ2Ao)kp׽ J A$b`i8. ;`4ؒA%5,*chu^.qF5mAx{9L}&i\qpAR= 0+['ٜ)S'L,Tj^ZyZH۴P<+gnY#\Q[V?=jeu K*o"Cp%ao=q%8nard=!GνZ #WY[Z@v5F ѕ[Y;Pv6gƐΤO{L JNlrk`vĎ~ Ι7ܵmvxX*`ƐtX`wCDm)WVJˮ!1A7Sodx-C? !_oIX.n\mc禗tdj!UCW2Gk6涱ӃWLps P+8i:tb[nv#hf|gt`t=m@tSڕ¯u߮(ߗF3{vs~mw=Hދ n+=9 Y Eǻ6 yAFhTNO.@J ;f T*@BP57"s^yVC|S|ƄEƄD솫م ‰KAaGVg9H6LtM ߇L*r|"sTzxb *pFH_aa axsā0XG=a&iA4 q>(BTTcX_mf/X*ǀ c' ZAbQƛx zKx$c ^z5i1\# Nj.g6 di&&*Z7gA;Y^<_Q2^~kOvБ6z&?^ \R>-{@#Q;"_-͝gz$N!VI&irvru|L@5 FE P<jYsmw <^<.ճˏE9w7pD0B6U+\UpwzZs[/ Y߻44BL`vAʆ0ZnE۾P$(7;znѫZ&.?3bnyf*I5JŲEDG ij.kX%{ Krɝ+KN:%?W.ڸıcVj "Lihf|rw[97}Ks"y+糳s0m~1g Sc9ƪ#3Ӹ& < g4[v|tqq󨝔òȓݼUqZwl5Sû/⿓`!_TqkX&brw8iL?n+oyN`[0R ϙT%! m NRQ@eh'BD=78NJRr~#Q4 yhH7q4RE?$^6G)229{_8~ eynIюs~gAg&t>|>A|';r VTR=r8@Ew*E !'2Kj12T$KdzbѤE!x$Djv]f Dc\rz?4l=e~}Qqcw퇾c[I?o!FrUY?=,UR <.y6PI*;|ov][Ń/Pl|B5YySXv.]nPWqzD0&-Q73 ma6{dBԶ1)1PBT"R8{F2{qUQ$s]cHREݬd.w67ʇ2~ \tlT˸Ұǘ1vnƗ=JgSA{Й aor6Ua"btzn._T9HȑY}/ C!ZP/gI s7@ /D$;][8;Xͭ:>}=_Nn/s 7rNMU.r2ХBJJTw>S~p䋓&ա7'妗 mDzH!gZJ{mdK^]oYkqG+HqYU-DL$ b`ȠUH⃿:?Jbap7FѢ!\jg0nSJjLqDqiIq EP#N!GzHiveZ7ETd\71XE tpSh7cq4l"4' F˲psHvg*ovQ\+Dy{< a|!a_~sܺB>^cMe|d1ޕ@8].,g2=?]X.;4]Xu][59XW/İG51S\xdnJUTjQdSZOjǩXrytykOO.{o۵ۋ/F 1uN}nPy*$65DU@ůrm|$/ c[ofdc\3G_O8XD1@Qm}~@cFBFcƗIjѝ2ʚv5,Q!?`rwZO㛕~g7Ez0]kYhaA]o?/*Wk r;B kOs:fY,\]b2<8U%`\ A9㵍R.yt3QzI 5~l;t9,>erxNC&*R3@ݐW-JTJR9f K# }[=j^QJf*+ci> 3BhVԐ,4Ә܁R9yպ5]n)T3y5L¤) _4茰5ykByX _%,u?}x+*vn_<%cj`Ȇ oHZa1g ^CxnP}~ÔXo" Q@LD Dz"vBO 1V mI1OIi-Q~'s{íQ⢺LJQ9+K%%~ar.Cй2>ٜ18"rKiYL2' y"(cuֈ+K;N= xh,XoɗiI8+jcl"S`O"vGJz19upW#*,qyvVU^UNJ*|In*~ܩ;q&b ඦhFc&"3Q]|F&9 9g6zٌ4rJ!=C2t5M@;M l[#TV= W n]:2NI(m)|M hL=i| Tg10a1`wTSXhbLv}@/4"A)O IrF$all&sYe`xzG'xvۧ oa\j4M=}$sdQ Ф05 EAْUq]v#W^sL m/S%EEr5jBz  (pV&_?eClC|jEB4, >/X9횈"!h 9hS%П^ aR6ykRRK W݊eNby-_x%ʈF:)L6Gf6E$!rA1s3"^T*hp¼Wĩ;x#-&Þpgp3Ot?:>:8`{G_&bBnzqAs$q 㖙[?J?<~&572T(-6VQP\Ľ*ZS*sf"*ɚ (Se%,` B 3nV<+;u֡qĪ{p1<_qsMOv=X$iE]BtJӤP'֪5N^'ZkX}wf>KjQM voUQ:3d߿9/z]" Zw֪@&+.bț Gu\azh/7\Pڸ̝{N~]rBK߫?+d?ıͣ_37'whw{vzu zQ+s|oM ǜB3gֺu;SxaaWY+Ӭ{oj?pS΢Ϣ ;{2OvC)X~%W&wW\\-'~gSƗ\^\|=}b]n 9m2z|TpL >G:f Ǐ)NS+#:Ckxܬeuq-.S:{VF?g#D0AhQ4vEKpBn&f~%G.0 V z^^Q.cd]ڰʎ|㋪^{␱?R0[S\eJ`do/](i{G$ցj/h/W^Ы _q2IJmJʓi~f7 "ĪyZ $~~TIm0^Ȼ%)vBu`h^Y~:˨4㲈j Ǟ_՛ܾ|v,$0Y[aɈ9@`X$"1%%ͦ-ˤTσ& 8 Fs@ї߶Z 8 UAPl9 @cnEbLQ;o`Y E~FZp]8&KȜNɬ,!M.a(qp(N-q>05 _1q{oB,,E!9T)Q04(" ;lAv|z('ȀϨ9P^WIӎUƟհ7z29B0Q)ɤHy#d[o(~)aGTo5OÐhw+NI$CN s!z+z U!qR|WdhR#^@GdǷ2gJRwAG>tq둏b|*[?q*vXm /!V6nBG!0zc%@I5[]&f~バ-I7iZ OH}X NHm[tO LWY2VWTߍ!6 3q$`qRW=B^-~ߟ^ |J4oqumAEOzq0:B?YI{wPWz7AvU!݋J $9F|jDbRxIkG>܆ॸqE`"o0}ZK28v<*U7-%MAnMX;iK(GIڈ "xei0SC$Cx[EяUؖ)"Tz*fc\ <^gsu-BAŐ.l\m_~~ec#NIbkf Pfz=N^<!-۶~/v<1n6JsnoBqV*^Yζ^q" U+?_${ǯKN5ZZ Ѷ 5K,-1g??OZbQΖ y /Hzd/||c./ԅJK$_^˰bٰF~`X[5#S0RO~?@}_z:,nuh^/ӥͭ+Cb|>(eظ'TO?9 sb>/!M OI뿌pv+p8Z8;6ڳjsp4Zt`D~ ..7Vԗ6˙Q[>71*u~ S\Z]BC;h}К7\iP~/W g^Pr"`: Q6UdڴPK 7 E*9Ojt3*ֲ$?&6YMbđW݆׶.옝쳝]}K޻|?-O(]vlnqWsY(AfiXŚuw24c63زK^vܝeGY>m`6;v;|i(z_~a#w6t==/;,o|1#㘝\l~7{_\-X]7{~q|x¶sǐAlOOd L5ڟ^c9om֐TY`eǧٻ>@2e[k.ʬQf=!l8XdlRH ei @A." j @@a7ݽJߪ˖Pk)7R,fQ_R7[RaZVkXb/tA1 Tv~oO0%L34\f*03Fq2:فMR,s((RDMaHR+bfvѮgg |1Lƥ?ubK9K_nOxä/Z.ݴ#vZ1Fp 8 UMԖ Tcԫ\xRYD##p먍8Q5a6l1 tzP +vyz fF $?{n9m֒.5'-ZpdݝB/sJſ0) ͶP_T~]_퓊>$8X|FOL*t.aTͰĮn{Lrd=\ތ_7G d>8wTXڄh$o@%%P9$U* Akjyh۳񞮲XIvj%k4M'I/< r-~::\E u˄2(h}6R8e~h 5.R;V첔Hs}Ëx٘KWMw Ewq!'AU 0(pk5 ~e2~IX=* 0O]*79`^0W+G*\eLo liZBB|Xh}:w><2y99L-  Ċ> cZⲘ͜d`h)1&Sgh; Y(KuH0։SK?:eK9Ry-BA0.6Vܤ~:X*p 3怨W 77EsxO)cӢb)xG秧2F3A&iRhwR>_kAtF15mj~8`ɡݔϰ/7R\l2)]q7#/9O`VEF"p-V2 %LyH X+ٜI=cА%gĘxk/˵Ғ z bm:_/ 2 IDEWC@]_K&$7,Nski?[3xlpr۾f4ƙW xĸ##0`@1;:3ud`> ep̘&@gntmYf=AM^AC>c( wHUn9dg]ƈ"wd7pC*WՒp ` cŃon bUEW8-+)nX#2SȢTz07N%d͍%P8׬`5E5\%6$](&_]*gH qȢK>Zxa?Тrj pk ѫ^ f6blZj@Df0"WvCqR-o)UHk[a^`ԏBNy |Z D|(xJmkfVLFZ+@)YfYYT3.  H,T&L rOV4$1C߆ 1B FbRrg*ґj"ia%V1WJ? #Sx!+&4l`2+LXWH\+mT*Lda+#f e6TZRl Y*V;)}ӊv5<߮$6%$v%յs 0ߒ!,' UQQyByJ]- ZC^m&d1A2=@UOonu%UV@xs&(&a.fI_\՟-@?Q<߇#Pﮐ3r )y7[[?]b,ڑW9BxT'/ŎCJ ͘:UjچE%೵ݦ>3ȅm75?:p3HoU& _eJ4Tp_B0bE>LLk՛|CچXH*|@4m t%x{~#0'5OP,؝>ǻF_;TFpRK$eh mBSrmtQ\ e%2ྋx-X% @ʋyf+VgE[XWʯ9Xc$0hQC,X|YZ`k^.Y/ 9 Nk!: YJ,-!7pXK|]nbt5֔_+.-Ѯ{ՔUnjͩY%_jw] d"gc2Įz oEfuкGGh |f!4FSMsB7DqZP) /dxR%KtIP>7qy/#!EUeOYSFN pLj#A#K^ @n?1d Ij1g ULIXDV{WV6SL3eS M&I_~ӯ؃s ( vi^[=w$UD܊uIG!iH9cg>&VR%7T\ s>3)V ŧ#a(f шݦw6ޏve=W5'.jE7 q#x wMY:d# SȻ6.=#>zlHRT0$ s G54(@n,􅲝5 j^٭'_2/|Q676ҕx4Fg w{q3vp/]] 2jzUc 6<.yxcr )WC`L+5(&zsָ*(6a#H;XpZDjZń0 $"" A-94xo*qS_it!v ˷svlsOӘcrܘfwk Ub@~vd 9ӦGFoj6  my܏@ W][P%_*o`Cy%;!Bmk4k-SȬ K6eKKtYt@e>]fgLmΎ{l]sMl/U!;vPvVDis{)lǟDN_',cb䎨BUN z0>NˆPC{וӓ}R##J /O)в;V1䟨mUI)xj4̲b:?3k݇[qѝ?D !NH8(*g31DAMl)%k(.x4Ez:>7)'e(/K2v&ƥ{p مU=e]2ra" f|FI"0"s]Ƒ- q=|GxI6"FK6#ݐ=I1!WVLpCĔ U THIJ6.*83T;alXUg$uٴmP mĉ?LPZ$fD .ap\uSMDYqG%<'gE`;#Jg*z-$,>*6ZƩi-]7LQBn{Ĵo'8&T6V5NkkMrطB wx9`ٱͮ2]>&0rXE&/(^3,$?c[m==V퇷5ps|xXftXk]=v/6` \fӿgcAa3>%hK`Hl{Yp h2I}[-__J¬C ~{(@E_,>v 7 B& LޟswC?& 8 7>kll ^Y: ԔS?Lo\|ɇL$L =c5r cdfG1P4朡cE$j_oXPoF"fe$9C㈝0=4#VRnIYaxc7DxV1հc*t>Gl#@}ش ׆HЧ(85E QbC;)Y"uH<󧩷 B+ȿ1E^QA!?&xG# 0x#EH4ܕw#hO+izAH?BYS-A;nԱӾ?t^9)SԴ)!~b8w ܀CT+@GO$P#MTLcPx B'Aee׬l=vM7=(@o) OԈbaNR+/4ޭD1K^%OFF+g~_>TqiR7]_l,2ٮ*̊o0QiPrә۩ ׹osبVd͝4V8yzv}ZX7W>t|xޜkɯD{gW;Z)+B"s`y.OAa_Фڅ4y190t:y]ȹϗ}}~x=>G3ݻ9z}o|?wq{ǯ}|wjA]W< wWF7O~s?pp"˶8g?H)~lDVpDBF8PPe܌x "]aJ8&NG.I;:iqh -_T09` FY  T.y6> :{HoTLP?ܔU%HtUzuvS-S .>oZgzxy{?ǛQs`27oRD<{y<>8U={gnMŏ{x] >L] +n'Worw`T{^]_^gQW.^u.9_7Oyq]ܗg'߾X')9rwmm/vOHָt[ 4nI 9t_K:]Bp M"o9FЅg>+Xaaoڜ&aHSS/L5NmfȪt9@Ku^~ E2l(ߊǗw̼%Lޅ*qExK M ]L`km [BF{@pYgD-oDmaTv ?Ih3`p)ɦ !h[l(d^9D<ыE7bF,c{K))zNu޺pNmd1.yWQ${<&\p^fB(+T>{&%%D=PCD0mK(_ ?)p۽hM3;%6iԻ! ( pYiׄcJ|$LBZH]O/G_S\o[n[% Wfq,EWX'xiE}3Ux [!Ɖ u:~ ڋbIV*{dȃSy]3.oIL¾J΍\ng -P<Za#,8s>"С`H";~j/&4(#&j _{B(wwky7MBNV?@m\7PGHX&V#:)Sɥő ϘPZBt3T^?nWCE2e@kF9ͱp*P7s|2}o2L'k".xICZp!*#厺-357$ =FB47BI@ XSTq(2.'͊D)=7sWHYZ;,lzW >pp6O5DZjp.M}5 _U |ǯ׫]C0 ien"/>2 N@PaY`R-H*d[ Zh20tW 6_hU5zTtzIku;x, X}rk;&*{-:e} eb[ɯfIn IL,?V'cPI.WyZ1ov=Q &1QEI$/CUKa o."Y_Y>?y0h6쳕Mm,yK~jd{LJwxLNeϩTa(d.sUsCCg#GK|cCq kWӄNϸlBPdVD3BlAF=]D (0Ƙ_sYp1+]o\rp@$btXRRe}ƩZ׃q7q߿}z}r Wޱ~_mS>O_ϗk'! PIIH?~9v^ٻ~f'oOnkH|;/?]|j})w-&v,xO%NNG87)|(\(!mv$ ĨC1;!Qcrqqtzs/_LX&Jx _O| =-;- |O8?ᣀ3Ƴ%sV(y_-K9h'Pe Ehr uMWTq Kp~C%Xirlk %&pю+%3T:N.oD;:_ [@?rC,Ϛ()Ncti!"(]cX+r% }#"F .  D1k@TB>e46*E˦]85&}F^x$~ӱ&΁iUQD|rV- :0H4ʄlfME %B+Uav P#A#)%I*A`V?\üm6QYMVlZXZmhU[ӯ.ۮc13 |,々VHljUqR.zq!yd <ɑV6/uDD2IL7C0;Kg{+f@IrJG}V/`:ܖU QW`tjVܐ"GN  ?"%˄kCpi\;pɛk(Y7_\.`Bb&/i #C䜕._ՖW"[?F"ԳjCM1+zOoC UѴ EIXF>LcVS][L[g-$?Ľ*XXH yardwG2#M} V~Qh;rɷF@kB>p;`@ +ЬlboRxru[.n_|,.oK7 oND).ft͂qU]a^rX-Má`B[!)S#>S jGB%|eX͛6| )sL gqZMJKeu!5sk1: h}PqOןXqZs]a:aaZ,#N1qf0Q2DHL8VTULC$A D%5`]^Da20RƂco?:A[a94v:Nʈ?; "1r?EZ2*->Yw*r$rC&̕5S`hЪxT ”d,5Fjdh 'ґ9U!$T2pٓNTT(b+!l s?aL͚D|B`ETJ]>DNBT3DYU&<".(]h?A+6i90q7ܮo+G'"`8f6"R"b(!%'S3,k>}K?Z|3diSï"Kcb4Y8"Ԭp>n$6Ib4NM"& 7 QkOqVX 2<{!V:r3S+:^* st PE ڲTu0qⴊ#<ޥ*sxy 9~I"B"FF񧜈Ua]{] XB"elM3R4/aIcP΂~{og}VDܩ^Ȝ0 wm$HX~PPM.JFD(nJ`1J=ʇǩ& Ҫف/>1"DG}yͦ!a NH9:C|I2HeZ쵠rP( d0iB%yLq&'VKXuboُ~CDY<5!vEW4zm^T{+MD =ZJmDNyphN,'SD-D¬`Ήf<`sS1.VQ& Q_!/kj?3VFPLӷAWCJ/f vBȗBl|B 8t6| d Q䖌@͉΍^AҴa`XB}b3~#G̒i4m7@F0caWgh[aO.=ODJ]KeW!Cd >FG3J@&*W܈G5EbFn-Ar  :&̶M Cr(DZ0!nB v3\=/\B6&qՊ1H_5VbkZ>Y:r>WA&*|ԓ$A(-&6Tb=p8L%4k=ȗ -FB p!`ʴq. Y)%Dh49Rę:@%` V}M^ MNƁZ2zEB_3pt8׻w_n\z0BwْPPV$yXbqΫ $GdB kL/%T" !qBJ"aFQe.(M <}Ә,Z YʚxG,A er2D>.AE22T%8q Xb ck}cY nT=*rgӥHGbI2#tp)&(ş<͊R'xfe]C+/--,lY?e4q.e%G63& b;xn?7`߀ɰew-$]&9qgu,q*b% \[ky]&-K2QQ{[ ^WcA=g7 !>L\'Ď޴~缊t̪Z0E,Fӭsu3A2>u@NRX!B7sUlJov+)) iNYB2k!BT+ G+^myEЫ2#p4uk}Ķ@dd#M~MśVȺMr+D'9ڬo]f@麡]*sR dli)'q߇,a*.YTlru2a?.V7ؤܡ̛KnOJpƧ0ZNVonH/3ߋ$S Y=t(s {;8FY/aik|0>WJޠ6{m]A1_䗈neV$[7g!R#]PV yu( )߇"z.QcZA[u )EYwf)l2]CGqp"n@H"a]SЄ`̞;johM8k[17{_Xz?W^9W`j_&%_>JomF:3ךKlBBr(No3 -;7YZ#Z}SN#H6ʔ;Vʒ9^8`|洘Q HdaP! ă 5El~vSI`1oY4"W\ˤz~o' ۄ'Q! 6!SK \ +Bx(@㨼r~:d+ `h2.UaU_xX"Uٚ;VP2 OLiOmϏnSMP=(V-Ht2V`x7-;!5GwrNLR{N;P<<e v﹯[{E"[#+20] Z`0v 4S<62.2"A{4YWdreMώ[Wg/?^tsmCJFh7<KonEҎ@S. fję玻jPVG; 2M*nbs\pp D+wK9\Q1ځ̏y\{ Yg/9`{=رHHjXJ _"9ɕdk ZSIieB&/`g%yf;ok-96mc=D<+"ɡ07L t%qGI//'oy܆nBQ ;8?P d;7:UCΟvd(fp=@Ri+WQh:{C Mĥ1H^)>`5b&_ EF5f聬CEEyiO~9 ۟٤&P[x#t`%A 0C, )MT5ncI/nq nS(t;U>lN{z1@a'cgguܶOoeVg-N2͋RkVྵؒ u M!x] :hfKŵo9EU#C%0~"W z="KI/4x@qUqsJ?in% %6Ő4OOf| ݄ [SWygŴȤ#WEILg_Y|qR1@ J/'v2v,  RI8b}M(td 2HA1Bc)r >UYf{ =D#D^ E8ˠ3#b,۩m_\@-1i 9WX?8=nC} s (~ dtZ-gbWbû2tJ9̛ R_9OT?]K ]Vڌ*NōL!nUeqw$$pc\&OK{s%,:i*u2FJJrq{~tviUN*Yq8 NGOjr(zsC -*u EOdgIITx PU(™OM nLgXߛ3D`W1Ev+Bh YNA!)8ELq W`J)H"BEd-gհHZJB=[z9 (Qt @kL3TjҰ{  5U GNʧaE)̈w _09dFX _PF$`x0,5MnMX^Y0RChȲ<.QQEX=;U/ :s*|}5f 2ጵ*^IٻYwб ~]a9TkJJIH{$!,&*ҀB@*R`.:^$jHNA^QF!]ӱdSl9ⱗh(@2$,]SW\G5ֺd"Z0DC,&01?~D}7|;:VLJfX3cgat vVrH(ٙk<;e֝_7Y5}ֳ k9ǵ{TACC_{U#jZ+O ^{s[Tp>vsOB}R}IRMb{?ϼýyg:B&Sa+CyC˙X2[)a9l~LrC4)TTDP47,"EL}%R=V1 !j桠=,ᆏFF5}]r(6@ܣ&?F\9Q~~q$&OC`>zC3]"!FY{HxsS,b%r[ K];B|_嗙/(?²s~Ia*BQW/]m/!U[ÿcp)iXmu`5[cA,G3`7̋51AUk8H;nwvUI7T2zR; i6޵({Nn&E߅z_ Z ȩq`Ҿ? \#@.,]#xz-jx4 *iS6ŐZ-&"0Z,%36 Hnm͐5 5ff6O*KAE_JR7ډ6vۭf<O~+L/VuءHts1G T3gӆ Dg g)BxIMz;&.tiZafvivq;,]>Nlxlx :3 +{3vۙ9xd_J=JɭK7?˥Om5myYzmwq+3,9NJSJ7fӭ!c՜>``_xgv۵]f& F|Ӑo|Y37ܺ]C=Q*RqƏESf > ~@EUuwZ X6 {yOĪB R7W2,y< &Y?7}\!F5|P!+ jI&(""2\_G'Bn*,V:>Vf*}b3R^ Di[^UU[LMUhX !raa B,ڀ,IY˛ܬD|F<0h{{nS5wKW_&MX6ø*1dd#YY$R) MtQ27\6 _@\SV˛v_U NE4Y  T#Fݢ?V]j09i)k/$\Q :П'Fcy$TC 2 @5c|)S t^OqQZ C:yqP q<=\"gx7fuh{|'ĝ) ;\s D`ȯBls*ħgLj@v-, wn"b_jT .ώ* w>>޻_TM__xxu| tį\9.#ZHr{vOcG9FTUXBXƓ ]7R՚uZ4Ub J>xg&I;{EGomVRsIwVwXt!GȢJITq~w'`]X"UTZ4_lT@VG-VV0R F%qPUh%#-Y3$u!M yVl _yi[+nks T搮o-~RZZ(AUBMI+v֙5ͮ a{cpB"Ao&ZntY,/[P>EUCY虏JGW?45f%F eH1Tu[c)4KiE-1o!L<٢Q*Xt-z3 9|Wutxw2?ń.9ե@> ౢc +$ QMȠJjwMQ<2Lگ-Rֱ!{358ܒd{B$aHP!/E1M5BGQ pxBzpU LIâN3ΏRXCes<׀l?k(0ĿxA8Ơɒ&"D0 o}ޡpVr907do6Q~>&_hd9XrtEAxiprYݐ̹$Lj4 =^v~쐄jw#DXP9({r!%+A<}VځE(Frw!m (Qܸ%Ȣ9mc^B@giLu3i(u;RfތP{X0}^Х=-g$2 +8oD%)5Afy~tp& #0M A<[Խv=8ȼY8\oF a:Ty"`}=^.7.Χ2:,[B#"C ,2@ C6$p(6 fBQ`=J|_dqd(*6fXPQzݲJ&es,J}tsoݕ_s:_y+g띃Fzb0{_eyςϟ7߿yޑw) 9;7O_֪Vrbaz}o/[ygjG?fܗ{p<ܶV웃p;_}sWo?׿V.r̓gKǝNuoV7'Oeӽ~ff,.#Wڮla=+N)-ݱT"Qr ȥ:^,)7\ ns[r < .}ʉ4| Ķ/?ªY:q0x|s Vr[뼲ΊRBp PP[!TY[%(F+K;&j7qPj `X)n2Np7|XܱLw 9 SP&f%Pl)UQlOcMh ]uQi5z%vaLW`TE8(vkGUݪ{^Be7ux]!A2MO %TRfTc_#ǿ^LE0e@:=4›yNZ "mkl`,mN֦^OadtǓի^?|]ϫz`eP׃IjR7<ʑRWYH *kXٴ54rKz:d.+.4C"R;<[u;)v 2Q`k- Tm:Д%ֶ{x)sY}DDSv5c*`񡦲 ޓ17zV՟v7<53Vk9 |".*mlaT  Jf%i%L3'Me%f$Y0dhw~imKvv([ G)i ~N42$-b]* TcżCI<}6HXTJ՚So|hڝAq0Cf((HǠ GFħor9Zv} K Ĩ$82Vdyc=#[+h3osνPW`/nD<{0Uғ*pƤcS}vUn1mw.TLV*0n3sB;Z][=ۯmUvT$\nP3͠e^U`b|_Y> UtO"]BB~(EF],+Kc]@ʨ)p* E-\ӵdUSKhzOs 穀/Ϳi vQ̄8ig~/(2,tSȉ*QSEy&r.]y DuJOxN=8}`m6׫;4յ5\N?h0 $o{xNHy;w׵DT59p^TׇQ.\˱d..2)7P!Q =5bH^H/¢]dN~3|DQ Bm%9;)_Mj%P^Nǥ?+Q--Wī+ EahGZ?Êv2pŤFE\HiSZ/-k#E,%p?AS~-+1") ]׮54k{LàGGWxqKə\ /TWA $ F<,]lPDz=bvlL0޿" ( Xq#yA̜Y(ěc?o ςUC|@b6̠:mw-iBqR@0b2yL:̄ b$Q4wm-n@d1 1/$df$LIߨ$0;=5-*БD`7%(,`;B]_~ ^Ǟ^)mru~f{%0@c^V:=4fq`x$ E#%$J82,S]kbb"mQe, O<)h~Pƽߐ0jrqy~trH7t gŽ3ҩj!OtDq/i'kD msi 86l9cH,p']#b 3^}fnܑE ٸhG궢C'`tBgfqϢY1a3̦\_@Yq(^?d(4ͳ/{7|ot[v2׫_OwVoh9&`yr=!!4I iڨŰVrIG(8řZkIufD2Z$&;y*2lItͱYNTDw6^d~V[ϊD,wON~& x+hk ({/^WJj8Q /0JqXJaRe4 LE y>dc -rƐZVͬTz"T9uvԮAlP{Cn* !RL Y"7C[[n1 \ٽS;϶ϷWhpkȋ( 6UIJ(0&b,IMn>#Ÿ=Q/t+)qsYM.h۵o2]YypKS\J5#!!)wbd';-M0Eu!>(&)UH@ISj|n'$YP^%x&]={ &AvCя6f.Zin6Jڿxvkxt˳s&`D^ /+0D0CV; 4$I;E[f#WF2vЄ()E)=Դ8o>@"dMnl*m-,bw2qr n\S?TA:Hݭ()+/$ml1Awkmnu+m4(@zx{؟t -L5uёPfEdCB[V1 >cI'rՂ8-?̷妇TY9F%DT A",Q}gavbKVqx25ɏqzV -ZHXF !&?( M'!=?Sà7^}5|>kMhmR5Ull܆l2k7ǫk5>!u,Xa5}4`g7YtXqϬլZtud;+eV)R}mywu͈'g42VB;I“x 5T>a (8 $ڲۮa_~fjAɐ.KJj $mLMk#BįZ: fL&tʜ5>?⌸?v-W}~ihMM(*yL}uk%V۲,2YdWr/+Bi.,{_qʽ8 ^dWrYY(",{_qZg>ک+O踿k=LO=VF-gc-+kY9X9gZV9?ֲjsb8 "z])sƸdnlc7?ԮMG(%QIB^OfSRv*I!3~ c(LB-FJJ HbMT6C^+H'~e9vxÑ'cJ/X[OE; C7Hp[.T iKQT"l߻3yT&n]koWr2- yt=nf&TP`D('ﭐ.h&Q1AV.`7$:^Jb) e5>j-ҌWU TZ`_9sou-Qáߍ*匌M;UU@`ё2aU kFYr XQ@KxEqT0%Rղ Ȩ\Rc@2k(%=5(tӲCNq ,Q66UcxEQ&۽w#i#,"_z4G-+Jn Ruߟ1''4F')TG"]( Q_{ V%hv  1wO[|{gZ duנ-iwKCd,uEhXKia3PF$w7P~ 1O]8/ѴƠaZvsVQ೬ߢ|===e_I8޻;2N@!ylXMR%\̌nyQ `3LգZWk'9Utk'\ E뗭 b;|ݧ=}E2ęCX΃~ޤy`k@N&Z9MH(e,2(Q=?:!m3VYa{WA}%VP"^3E⬔2|ۛ=~z+F9x&7wɇg$$t²pDlB|Rq4P I\JAKʥ@z/Q<\T qCnr UռΡٗ SPJx<9gMP¢S7PI+h-Lz&MaE-B/$HilHKal⃊-j<hhH@V_4dABs74'poCLoJHc<'(uQ6g Ұv/eEwi-/څcv̏Tpn.<6?Yb22 KoxdaM`]HXP կW׊c(۰[EEJŹL9iw3rNkJ#H&B‚ 72k fb8+ H~FO_ѡ'02 C<:ePC&EQN:L)џRi-Om\=k5fIʙ0ȁiڶ{) gF,%!#FO H<*棕jHET`զf CдbץA%)Ycݦ؁pnM+-/g=/](cyx4 Ųѿ98cKWNrWOFpkK{t;|_)|;>-yk ?wsGNzӫ/wa;gx>ퟋη |wq]]zsOq?s{_W|OO۟oWn9|u{ma믽_xW5_{<Wn{wn~z{7x1.V~#d7L%nMʡL64>KbMԪ ̄ QhQO!VP ..*n}Mg$l 12;ܖ~"-ED2:W,pGch4 IR 19ƾ@ 4@u\t+%L;nu|1a7w iHg^*b&&U~g? oĻʴٌ(szK.P춱 q#"Pf QƽvI'S[i]mo0ŗ rIVX@fG;=YL- 86ǝ%z}z _&*IDL  L$(dg%ͤ q'M7l&!NR4tp.M 6)\=rM0r=rM}w1)r @A vxAą`c# ~UҪQc([ ЋPq㫷lNsfF90o!(wRpb-q玕la'>+0gzK?_ц?ҏy.$ iD8Ɉ% RYLJa7rdxA,I?ĮaJx ζJ?YjnWE<"I͓^YVHߩ쾧2Pb* 262 0* /[tQUL=7T"h':_ g)Qք 57c,0$Erl|a H"*cɯ_|V!F#^C;C#3!]x{2x1 [lZ.dtu >>=3B`$Y!2brDd9YsF2f,zmݺ׺7Jt˫uf&ꫭa)C\SXڬ04dK1~_(wbqs`!eziRqiܘQ()'4. -*2zF5Xԋ2Si4AirE :Ho?:nw~n2rȉxT/D}sV9=<:=|޿`|?<:1ήvv /JҒNwܷc}~}u| %-,x-jFz}>Ͼ</}c# *dƒIIh/w` W}=08f6Pm F茻SACvO{u~G @ 馦so?/=c="^Y-N9 ki$kD[ԩ Q:*'+x|:e"z])ENAfK9Ѻs-RA dE`V[`eh)ڦkfyپnnoDn-7,dTkmpjg`r[TFfYٳ´PhPC嶲=oR']מdRRISlBߧ͈NM3dO3fk_otp乡)RPVS‘*8m2QZljZ CX(XFwPazHɰ.M} gGЪ[?\Ǣc^Q)NY]PrW8#'1dzՋh9CT 2N4W^^ SYH f%*>@U"񝂆9,~:=n6dߑ@Zܖg+| h0 P7nF n԰ej,u 7YdžU$FRxDrܒ^%נ:>5 IW%czmf`$C UpY8]y\v[{ɩ%̌;*,nŃc:O^/\\9Iכ͂]=<_w/?;W_s=vQ=Oy͡Ӿ:8n=9Bpz;\6-vu)}q> ];,|l~:}_-Oz;ՂnPeSl@j}I~:ƎQ j Z{čJ3Es9l>VM3pOwjsמݺ?曵Up{ުVzGt0OWd>ykUԼ9CݝFy.\/߻ ƮihӈIILeeNd en#)g[ٵPVe,trmfZ@9'VqMaښZ=,-<= Wߝ;J3vѮӨ}:}>붱Om?K.zwO=5><׷9*Xݣi"dY}Vm Ba ĢJY0FgT(9:7kJ3o.IHoQUR\b.T}#ot#DѴLU0bl|t5[A[Zӵe5y[OШF ~W ;*lD#"k䁜6hpE豚BuhUU%].M4׆_5k#T` ?r5D%n9@AHFdnhZ"Q EhE'c 0}İE8 aH}*"E+Kޞּ>T( !%/ۢbdS%`XewŧA|,aK>$N [ ɉ$ gr$ZL9ZE_ťԀ]Ur)лCi&d9-Lt5T__U+Ë2ShJ_,L啑[dd/9B`WozIԳb5=eÒn6&?Z ӺUd^qfG-39[,T 1?j|rNt0S>s/åpD(@U` ?=b4tD1B> KpYw50͏̯];UAXPGq>in U}Cͅ20l>-PlFcQ!$݈CPY(=WAn VLJD,%.|䌮'([F Ůi!O2OwcFB@UST{]zzgVWBjwԮ*4+f´FVY0EGA^ecZ~MVj2'VG. G[!= 31KF22x+G0؝,[oyFW.w{^MnNj>lMxMR9#T$C]&Kߒk^2F$hY9-"N񅫱|d1ey;~xq*$[*b@67r*q+\[_?K z;Qictpww)L2 Iyjs{jxr"~NiRW'ʆ>a0OuG-{F ^x!a*|h>}z8߭ç+&M8sp;i^/ YJQBBm9ʈ*QM^\m>bn.HqJʠ|jzj~{)\?3`Ż9~YxV8&o7p~ҨOF ÃN[{ gXa?4v no_+o羕NU/sr_r7_~U_?'`.msXTߟ \m/o٣Vcp1wk~ÚZLCԅa G*q6J9,o N?#/3Y)-h L)?\HyzĖZ*eyMumѳPJ]{(R/nY,4nˮWE ] ~2c}msfo2GHNPP,ԋi|F1:_QvGL!)GTtQ7  9*bl~HBfs4J[Tp464NSnZw!dv"8\"NkezRjJt+d8(Six.&6 IlxʈJvpE $OEʯvXSJ2tᷦ' `FRdM:Xlj^v룧o[mzP;W?wիeӱ޵}~|8>h Qv]Qqiզo4ovw>U[o_76^d'^$#x.x" 1>5hBoi`Ah#a9l|utMHљ@sք~Th& ,K @8TQid/a ``%+Y_j-ڵ4Ɯr$ p 1 U ۠s3Xtd"Pk5+eViZ679v׈ ǯ[.IF7 5+/( O$ Kb"\3q"ZTGqGe@EtrFɮɢ1(«sێLq*gw1;uvpXi<'2p6%"1.zsf1/t6TaMWGR/CV~ӍL]Q =-ӡ)4jijƯu RCO>`cm`5a9n 0<[\ O'yceY~ss#yvr>Xtnf,E (ђenL)<'p{! ŒZarai"Jd10 >,z ܇Qk{む7Y/No]υs^*ESyܼ^ BkteEO+;I@%~vZN U7'QY'ҹ,~lhgb)-idYP?Wsi?sxY,&6/lłKY$‡m@0>'=RtXNIR@O5L(~c\UV\E/BK*Jf~겾~g~$ewK/ J;^5nsu;G,N`vrqډלڬ5q)c=7vEEZAXQ|T _A裳>c vgn|]V8_S?]S}ea_dIJ|y25*T+.+vSB>b1T|CnENLsݦoDZw|fޜ!묉Ϟgs6T|^γᷡG~k{qǹ;=A2>;TPa>*vwe󾄮2Ox{7)}&$!x@px8CKAl6vO~Eɐ4݄W7WyGg]gFDTm:`RHFxVx刅h_DH1ޙ)mLQogLZds d 6D\>)xĵ5/Ugp/=jN @xVB"tfL 2aI5qRPmvC'T~ӔPG^@qӿwJ 2@FnUw]GH̘FׅBt1dRW-H%EAMI8SɪSk*BY&RяN];:߽<==l|Miu]iFE0d%tgFδ}/+WTe/͜$+xr"W'UƶD=ki(hP\gB L u?ڋzoI"&v UrmNU_JU 'xmvKcWi0~J!yRNQO׈^l)ۼd'i88*ށ1rWZ! G]P U,֯r;%245pUv\r&HK~Af3FfcQIY^MCH#Eea$AGؾڝZZvc02M$C)KgaA>ڽ|%- XUngq7~)-j;NKFCֽv&2jWJ@ayy.ќLb4g,b9%MESd[輶6I~Iu"4p8ox@hcSuAh`"*Ʀ@F yI&Βu c%|(Я?1coE^C2 񤥾 |J|L)7)kԂL]xt 72ҫ )bE!NocC,Dt ORĥ"mPlX_( Hz#|CS6ꌜ#jdN0tgI g6֔ԇ wCq)+])vn},8bW^`oA>SLC-OePU(bXB~5,װXn i^`(֒2 ?iM U u?-.ЯyBCuB Y\Vr&ѵF|VH WTK.avn9KG+F:=#2!`7٘Y`Hr,ʡ3Q=G丳狥;#S 9c=Tb8¨5\`2l뙴<0AR:!-w %3l)tNSȆ<z\-#c2#GsLP K7sԋ1Sj⽛`H!oǷY)~ѠE g?,-tۈODތlF .ѥ EzJ) xǶ‚NrqvQ,MT1BR70p Q< FsfB@k[qJa'Ζ5Y׭yn"܇ /OdYϯpOV8 ؂JH\'GT8iS*JsȪ`#},~tUC>]1cJ'egyN+*H)mFB& _$F[d>>(H>-mvS^ +<ދY:d&F H "y`-[iLX2XA:d{T_p !ѧ\n>WPs:-ZCSk-ub\b7ʚ$tᤰH@{órJ#LZX򸈿#Hwnq=dOC/yg%MbbTt~a8d ݭfPT,Ϳ<Zj6Mt2Xagȝ_n~7K*u[}ea,B.Cf+ɇ6@ Bٳ4_FyUIuE$SPbh^ s*7g#?zkD-o悄uPԿf7l'o3@/GUf~zgVy_4_G; 5?i1Nv+5Ȍ^\ݮx]>)hĹ([ĺPʻVvZ +_R#|;o`€~%i=7EJ:5-z7~w~o_9x\x~w޿*h/Γ::tΨ&DIfT`W*ixe[=/)QOV*xǩpϺF~մ_+gRm4 Cq3^?>Fdel)PF#p\:v[Υ^펩9RVQ+ 5ɩ)'^6޶13g0>=Ss@"uJ )jBfy;D^v uv{AðG  Q;]+ٱ\h*FbIw_ e 3^Doz0X}ƽ76Ay'E$QW*JoJJAAD؛\sq)ՠfHEk;r(%OGiڂ ^e-F)C8v'}S.U+ ~A-O> "4S Ov>`eX ,b󰇻'kaJ\[NG>Vd<.GqH\v~Á@yF1 lNBOuX[ +&_Ok媼7aOօNw$1Cb;6ر|~WkRUI`һIRTw 3:E?ܹ+\kŃsyѵ5v`{ylBpXXQ0Vj'ڑe02~xp&'AW僲ТB2Fi88&dc 1khW.-dy瀬k᳔__h9)cJ~A1VXhК,pN½b@6y-'WOqTS]lUh ځqp-eX/lap՛s ہS5_1_M)0 > ,FH#'VX>+ \K }fd{yYtBUw("w'*™EG-.Mg!{B1 ;Z,D8XuY =?/F%yG\aך-'#’! h[>/7 WZUu ;ԄhE&$T\p-Hk\p`b[] v+ptwX,+Mz ?n+@\qo^ȊfUeh.ŔYlK>,\9p]d\aˊYU;T%$ 56^cYAKpK_&8V0+ф,Q$Wn !7+̋&W!V.3$,\(rMմGH~QlU8Quʆp@xIǸ/4^<ΐp_9吔cqp1/4|!J|%}XI\UEL۪줅؈ m(./,Scl1e")f9q2.ERTuNyČXHpVv l1&c,yr/dCi0.rbGd엡 f#huīqj$q!9Qjb YHU d9pOfN/ȍm^v 9㞆K11.QY) ⢃ H|e셂ބ rW;7⌜ԙyy5',-(QW0mlSJ ƴfT&{ArCʃ zBZS~uQW?.p X?v\>qy?(#x.N; bZJ{P+r+џʼ\qv[shBUnGp,o[; rDt^.#8(u("mqzc2q O<.aвHyRw3֤]%5$$q4a䭌pM.TPMT gmP0IW[pVDEVi8Tq=FȓIYU5eB#noBTnZRƏQ]ʨ `c2 .k&aHULbոpD\`aZ8ȲpAǞ}l&j(6q\9JY*c Q&]Bѭ4 .BUZC(FYr^s5ylb=])~\Fh! R֣- l?F6M\idmQ'ɏz7B6NԖ=Z!wp4^};i2ѝˍPk̂QDÙj]g(ڃ/ѓKO3tV),ޕƒ†'5ܝp$aI(HGUX0rs=&5%iJ= %OlV-+zEјg!UO0Дk6m9x"WAQj'3|WrQ@V"Xj=mqVsL5nz6Cot0{rHā9>82T܎Q{`e VJJ[8Zq c1@{Ց"۳dxaFyD?^Y Y[}QRr(IF`Q+a3QZae-£jkYv:8 qJ5ۯxu$^SϢ{m@ogU8}n=Q3AHr%<`O֬Zڂ?-Чxt}gCۭ=:[74ｶk>z0)#¬XAp4hx@@/ذz9%88=lGb`=K0L9);%'5]*0r׭AYY gB'2@3é[ z<4-Ċ S-`Bly=:S, Bh?vi?~LC|$Y)$c$[Bv 9$/"uvԴvLC3~{e{YdT˾@ޅ7nuųz+|hÛvٽ]77n{wv:;2s9>\8N9DRG[;R("kl5lxJZ h}}1\^0͉ΏlX>+b=VlqLd=w 9_oek//T_QN]zXިW>rԦcطB%pS@L*fhQM煑KdӤz!}Hc+޾'όW9=j"a``5c]6``4#֒ GC <$&a EGʕ3cSX[52 \3 0TZeNX-PApi,z,1iA\  Y\A yMI%<!i kCL.O^Idt6pU%qi^4^xv!%IivY=#V=!KiNLV@0$&FW"S4FiVQD=-׵Yo P(eƼ')(cRDqS?"O'>Sf,ҪI3V$f-2x2 "ᷔLlsv;H>&)7Y*ݲtFUoO[EN*'js>(VUjمH3d"AZ@L2bҊkT0Kο1*xѸ&W@Ygk=֎z?F\?I~4HԨ=P% &08Ǘc`iX߾}ٸLGO,2r,0u c`V W'pcoNs/GZȭ; ,1<Di.ςo w  L2D/LsUԿJotWP0XSykxzIvYl6H <c ߧLHk or&oAosҐB%[XA5?O;my": <2l k/87ͷ~}χ|nai~rd*x^x\Pg^-<[?>ϟ#dmWpn;%λ7t.ȥ'j?l ggoրC;]]!gg_!zh˼ {65oǶ_[Ƙt.h/7)RRFQ1RieW=$U#k9P_/NؘXULM6~\@ 7΋sU(*A)E|к>(eLQq5{C4N ɐ H$asjcdLmbub: TޘSlqئpȉ:bq9bbu5r9^y&C 9zE[\N?0T m$3t7tb ̨iHX1 lL+M*?ֵdp5%MɟV$ D;%9ٮ1Sۿc ITFHa՟v_Ûv<t B]zc7g ؾ 8lkb<g0dL?DnF=q:wDt[G^ ǟDCT ~n2{g, ExQ@ ?Xemp7:iLN42W!4˰KO͛P$`=pWZvv֚oW2Pv$- Bƣþj|`XRP6X'mh̋*DW $ZȦG8Iql:4#{1IuV.;3a'/9H u!K^\摆yXyy )Q|")E+G+VGL6e+A{0oj}?[wncs ©GV1.Y~qu.Sh c>ILRRG 6pJ u:"8p"QvGok%NJ1Ujm&IK^cKL/mF"n\!*')9Zu [*ڪ@-LiH4B㎘k@5٪DZ5dcyؔ~ Z/zx) 9oû;EtUBٌUƕ&+lqR\vB eBljM΍퇨"Q" ,/ jqt"XMKrp{)2wQ=,zXW./g+TQT[6*_xs mi Edȹ1 vĽ" 3/voa#ޟ(AXIEaG`&*]Y-~0hz}_[X  Ӊ|#Ǥ3EcOga{#_&3l H&{2]yY*1ݨ! zȰY\[ W.+zlnٴIeE鈅 #U "&HpN ak޻MĽiۯkͶ yamMv m?y~cp7xjUVيVjI6h2u۽oLOV l-9{r!vIW0@g?.~cXDPgU&)+#ik9c;^`4Zf g+l}YE/ Il5G$ص7$(AHSv+rl̡Lt7jeyx *N,Rӽo,%\HbJo9oEiW=+W'ՙjuURK@a.](L`iuŗ+6bN=#f.lߢ`ۏ0׶NMN>̰Y㱠PY\"10+W3[houJ!^}Мt qjRBp*yj`\ibɄQOư4%k^"hO5-A$;ARZ [4xFxЕZJ!5E'J^aŋ{*3e$DD|a7`nRN.VJK\M"v!$fLD.Q66F }`ea]ܰ!T^ȽM c)Q"ON7̔T[Hr"#"+Gt"jFj7lwێŬ3o= U$Ð+Ś9Q&H Ki2QK Ks?pi-: ^X?r |ˏ >Qj8?֮?|_ }G؅?^,Ӿ.1c5 6Vk%^Hʫ\+NζhgӌAI8<3W\U d@A‹؇Ljou)EE >yEMV+no#!j'2&૒q:$_^AD*v*v:02Q+O)s>i KL#;! ?Mr> qo//Qiq!I4ZAkzvpGޣ !F4< #] [9 Ov,'D=,a,=n\XՓ#5չ\\8w}ՙUiGĪriʆAˢ"$+Ji(לH#A' d.gDW)=Ϯs?s~ W#|H&터/ 2d^DL/ 9@lOYl:% eȃBp5;;]SXC+עAbf>#Q jvt,=)tc#0a3+bOOk3.Fv['tڬ~>#H j1ǃ!E%>8w)-u`#QN u|sql+Q2x ?/*΂5 |MeQnxbǀg.RebՄ N;{7IKxeTv#e<]-&}Fk1)"PGJ/,PB }pٶAӌȳG%7[pISJ+~"ֳ]Tx} ?׌(Ak|Oh cA`R?"*uo6 dG۷F7!qR{+vt Ph &2 .)v/v_rfQx psasPk N x{頂% 0L` s2rR~q}@b+N d{s!SjB$ۑknaL{O}DvѰg]29%޼yt=k_.-$~'#sApPOxI9iI(7QSI&z4Oʈ](OP -$Y;^NR,J!a8OSIDzQƬ̤ib`K!}4K>Y^cDAȮlS*PDHBe=$H8!hRO3_eLZӼ:6Y\qz 1ʊqxѸj<:lu$OeEHWRK iH!|Ɔ@%t\Iu&D0Yon3_hE2 <!~p,U;U]mXdPKS^J4%-'b$ ]־n1q&bM* dReDp9M }9b;T4TQ1$gK}:4 CbL,1y6>y8X_nUJX(mۭ[nT%skԾX!Mm,ip9)9aLp3ʺ͚go 2P RI LˋB᪣UD@P*/f R>7* H\²R HiQKrQKåڒ JJJ¥y<̡ 5R9 *b91yT V&paQxhUəoTOGR?B6l~nqr=w!zB\QF%*`bQ㳋RA<^%^V3\N"w&uz5:.=vڒ:HK֞7-I $QvR-c ьϼ\lZg;: pI bf?2vB+%;0 ^-,U[uL܁ʓ!- jKl+Mj3퐴8j:9@*lnRm 1:/7#L ,jCeMFl;hUڠGxPU }[FEݖtYKaX+85Vu͡P%TígD0\ʳ[ BfA 4OX6Xk1@rUC=sQ 96't~F(b=0j2ŵ)hW#rMzo?L"~eHZʜgBy8S@ cԪ7Ginuh.&&R ޓTSjqbu_1* %kKc+L&B_g6aif¤*Roz\ dVZy|~'>6;t`cƃ:A_娲2YpdW'/'_,茜*fq$F.41\W?G,34X7İX &) %#_._ȨG` 4_q P= \9`ͪ4] YQ$_D'I(ԏ;a@":[$I p 1O?cLsdFhnȉ&96։&z!;7rYۃ>WPLC뚙-mtW='!.R H,2@ܐB]D%-ІTkl;)@ZZ7.Ӏ9T)r_nc c%!n~ISpY(3!;BBt1;8yF4Aj!Bldȳ9& ,0df/NqtƊOp:zy-6 m񼑞E?2_^1AdΨs_'J\;Y$y~l5J:f~A=*lhg^  ;x;9ͅ,?2R= $8|r,Lib ϲ}&|f[;w0LH1vS^\6yVaQv~d1૚ϓNOҔ] uT7$RPD4g"3k->cif ^tyZ#YTx= oGvZ{~rPUD!T9hy\_ ΜPM'ܻ޻; xG[XNtIi$\V& Ԝ'[ez,(DPQXE~Cb{ghGoB{<د D ēTeՏ?›7(t#AGbyw9K SϦh ]YُQ›!!,.pZ5tmp%]cFvnV ;s) B{@ O\Rc# :,`B?.EP4O-f/kPKjBC}=~zENyܤ>~tfJqk[+ڱ8IY>J"yM3'8~'6!_y~K( ZLV9*`F=  KE2nW6T0AE\X?1KdOxOQ6[ʥQo{B;Yks:aH3i|Թqr7(U]āja`[w]_ٶkIddK= ЧӮ:y\r#VXʹbQh }+lf 4*"\Xm CָAX{5v)6)ȟ[ zuOrw.e|QBŅEIaYٜʾVF߰WqJ w@l >Zl 6GIhDE/ÉgH#L5Ȥa mg,ZBJKSo'r}:m;Y}}x8s<_g~?u;tWC G~*:f ǵ͟ðo<}2xptpd'j_='W_._\>|}Z:? IWwuּr%} pylXuH.dJ t]tFX"!4oa1J)Cr:yT J=jh8^P j_4B.#`w>ˆN =/5~e{5B]/.kÃ>/v?U>cu2wV[}jܱݪ{}xyX::~huW2F=3xدL%J;4y?AK#qoq#8XnMϱQSNTR_xGt8YJi"]dⴘ(^՘W>1Æ0Vl~Azʼn=ΌK!q3U=?P!Z&+RVS_7ع'VjZGZ;_2~0RGpDƌs͝ՄC#_b-u1WEH~ znBS-pN% {.+FHM't p7(Ye/uKFK$+EGz)']I^%%oI_JbkFU[)EP"$kq/8g/6 F8|NKdf:p1#,aG EbY\69Q0?:m_w뫯A',?]_t6O_ϳ3!/+=y,ڢX;9 hUf?OSW&R'A|gZk .u!0FjtBK<N V}by\DXx|'[; 2@>Εw;zD8E:61kwX![F#IȂw_& {0X\\ 7n)p˽vK7w{ ɗpo+K b;> lnŶ\in\nyc9Fl'c՚!;¿>ثgGl7m85[G [Y{ )w(!@{lABH_`榞{t?9 >߯Ffj}uwǤa(8{+=jhI+m4?:Z8ԒZ Guvgmn2H(: QC>nocR\ZG KGv2fVI6h#DZ ߐi-. ΍G 6D[fz7j)͔Vڲ_>2]1Uk3-h7YbB8%)7 #uV# yѳ7 bh 4dӌq Ec,G; RR{&[8y(Й]H gE 䛁̄"̼q'w+rk-6 !j+vy=cd0nJoqΪ}vwLg˩GPۑ9 ZE<Ǡ)J4V+3'ʼnJ= vrÙp54[3ѭ6Z 5. =|6zEdFwY I ,  >8&` 5.Q³#F$X0Y t,ZpUO:ikA+2b85 d/CfqLb#}.Cr#t1hisGJSi#rir6D 7~gH43Aw\DX!yrAx,Ywǔ:N< $mH/I#Վ?Q$.y: VOcRɕӀf}詒l=*d}*TSrX߻|򮖳V}=m׺([>cةl1"f"Z ^6KZAXoyzk͏@4E ˸6Mj% MkR6ma"=  3^cgPA|N*;{)pBbgB9MuQ ZamP/0#$8w<A86H~(Tv,֛V߫ b` `84~MoVP z-)&(f"xRVr ▶vdoBU;p| -E Ut`pggkX;Eqb,Ӌ>łO3ys]e/! _eM-"~99MW}Pmk"ͻJaЅMÐ'Y[A[qLۿ{ winൽ.d+0TAd]V}HBY (TJn},VĸVtjXI]U:Glej'=w@ ѯ[OUUu!鴧v:gg'YU ir7ϴg~"=80/ĀrUZ?S^#fA% N[ֆ  훴xèBў867ٌ?pn2^ d˭(lc2].$cRLHs$\ %8U-oHDyB9k8 dXN eĝQudXHB|Uizaw)t--TuBv94}HcbcӰXr\w!aD ?Iy g_uu`޻nW;}ڹ* s9x󕵛GHCMa{iw{;m-eNJsAam Q^C!jhEH#SwR)%D*"bMth@EkeC#ο$"p fbޅDtai#BM4hRgN\1 %1Р,^%lI.is;$\YvVzݠeIv~Azc;g Iշ\65g}řNhrUN}9xXͧ_SpfZįœiO`,-bRIL+Ys glB(G Sp SJ# 6L !9D)[qJ $y x#"im:K@!TD\tU4Bsq Y莤:XM c^X/Z؁g*]+`?N@jJ=KWl!zo2)-)73kept6σA %!10Lg O  I a5 qDAb޾5 -'ﭖAFlZ`,рߔL l{lGuJ6%YS> AL%%$u֚9Xco[wM~9 0jн=vu@ 7tgGm/nnork;>Ya'D$z?l'wXD$ךiQaiܞ6}[r9k>VLn{..o~GW5<- m}9><8yc1h#NZJ܏1JS?oQ5@#Yss#A -d+N+X(%C/t2r$ $v\ X-#j),JBy!γq]|9ؒR-iGgZjl|ުWr7||:; &vtOWLrwq|~Uj!7>ߝ_:oO{^l1pvW-⃷ ?LCz#6>5=oNwwE}vj1{6x< UΫN?Ͷ/;{gWp=:%pgOA׻o/2g[w"`X;73ۣLخ< sʉd|<=:w|=bǿ᧽^m3SaP/z? Ogܫ݇C6<{l8-]{Zkh}ȿ=/ùfpvvu󩚻Ԟ ?ݽfm׮ubir~}6TPwZuO{C,wyW?؊ vs2wxi^Wyvy{ 3 _]~z{u ׿7W\uM6\z;q N!ˆϧ}!lf8ߎ_¡ng)>7ߩZ9[Ek|S W`x%m {*JF|K \R8׵}I/Jd6>]o U ek3w팮.w.vw  W?S;:?z]jiq3\b7}/_`ͳO1M|R)EɧgD~_$mC}q,Y_kH=Jo7Ϗ^/QHٵH?s%^c.\84׻43[FXii+#m3P1N*#xLk!LʷbV+QFITl=v?$?& Ha<Qj+W.kao2 iqo~;R6*".մP|JW툔C"n%ER$= 11cDJy0QfV'aR^:$uUxazYgu 1-Y%)`n"=(bR)J9RF3j)6fclG ct'yEDzPĒyzSIw}q?!&6ʔc,; djG'4 lHbGKL.SBR.j{"ۤ:Ip=U-w0`jJ{g >MG hw`n{wUi4N&rŽ]?=XDPzxmЖ+6- ZV5xkvmv{2ƻ4p 7YE{~? eV01o a4CVyt͚n̓z롑&.(Ywv>x5yqQZX౲Vr]Gy EI"}B'NhwVCqfŮf qqBxHnL ռa'@_i'5; d+eCr;Xw,AAT4;Coq| kqIAb/cC )C(X s'xZQrӨԠ1 J9w^3K EN )OXooaĽvK ȃ-R֦Og?[Y#55- Æ ~-Qpd1^(%-rLD> C;H~>_hvԛdӒD=%"mrә kc21x^΄ 3XSz"Bah2uHV.3`h[3zh2aXjtdǚ)#+IԨk^m X(}=yP [OH&a!{dF& FpxnVœ3آЀm8*橇B{t%^TG~Pyng،ՏN[#J 8fI{=C)6 $]Љ>RLMC,%-cu^;7 (pO6O(I %Δ{jS#:P4(`J E/ .l?ٱ@>a KcROfVDJc*V#|8P%T)]$=Q7K ڝ *ld*-Y' kB~<^av-26 †){FW-ϋ94_ܶ7']"L"LR5( 0η!j3-3D0A۟؅uQ ,rbJIںm"A""Ej͏n}X}k2l>^t[amІ:ocXZF)MlSyIVa]5TV Hֆ>[ZV?a#Kjb0Ғՠ$id'D@c#ZR#GWW/΀,'*7rcnPe:+<n06%(Oqc!$qb—.]]?@ā}Ttk8NK%mZ{c_(@2\X~Jcx>D7A$q_U':HI%{0Mk0ƶ?nC=q\ۿ,fBO79E!il!+c]Ze+JlCҞ |s/)@znO3 8we9u%Hl8w_<ŶB4F/=:g"frn}9wN.DgU>n 1SShGx9_w,؏I,=g,>} 7~뇰=ֽpwG^dadpr?<a8z 10&M,^6Q&@@_ Fi\hu_릒K 1Z t5 ? )X4l幥fu*;%1'-+`Ճ+ A^=XFF"}3vԃzdF條h]cs4q?d@QɄw-]!gewJ4Hr_ٔRH(c4P%&ե Ia "f@Ùpֆ>wە$R;ScHM=zeثλy`a죵)U:#P"WiH39qDKA cKUpkHaDeA?7]W2 h|͈+Qҭ8}J  G5 (Pdn 1BB$!Y #kd'Wn@Jf$ȸ.Jk)A3 ŃL~O& 3J3h2pf]ba'& 0Fm @c:{J O(1jXE8X`gBlRبp2 |5ic"CI&)y׌|2&?|ANjsڳ:fli$+MJĠu&eI5V}7{%BE@vB̺PՌ|3'ۯe-|'$JrbMuB Wk=@  Ue!U*TÝiCG"G )^ǶGvTo# P² x"C#\B/W ͥ7Z^~йS*w)q6b"BQGzwV#[ i#O-*։B88j"i/҄NM |!ahdӷoqLkmV|(L^ Q|}5~IꜯG_o|Nt ڗvMF}c8#k(Qr~$(W|K2ޏ#r E>[^"ψTeÅfjN3[y~íyx?|ͫ:`8zBỉ/,< C'nv6b~̻=jIodYRV0O >)BDd 왤-Cί+q_,ri#"*bbWp>=`@b !q)/549>MN b7l0rqF$'%|cT5?w59&ᄤ" & &/^H"0%%RNH\/c#d[sy\ OȏU%db=fZk֝ihz$}7 h=x7Ol!E*PݠƖ);-_a!XXq~6,I^xJ\}ϧ` L8 Ӊ1/@U^#0QBep#ASֲD)m0(_>kYjW1S(Ϡ8 B6Z+l}Wzؒ_ebe%ؿcP! ! 9\!/1ofcc͞Nbx#yjVHJ1N `CZ]c@W۷fv Z]?2'/ö6O,m.J"M_ol]AQ9\FDh'91:m,˖{,}ռkU-Kg-<~ iS$Y` 3%e#^K".3-i YOYq`@Gq!uS#_3;gߎ]w/yӭVxsqw=wV ;[݋Ӌwy-Fv-ܩ_=ˋާBAfK_.s߯FaI/mN[;ə ł1r~+[LJi}N,>O $VLv]`>s{)%{ y{;nMU$ ~å:n+S_uG<*oCf#66Y`:ä 'VY5o./M(IZɔݯM N7+̪g.:Rz妐R%'v$ dAn@"ƞ3gM?(!ȠpOB+Jêp>bKT\^8~rYc,;$q@VUsM+Z4U!}VzTb.0~S+T7 袥Z~hrZi{5ףxbjl*LI +k9q\zHKNcdԐzF#I>Bpx)uks^Oizg5wW_j.;ulv 椥/A@&V3Zij仓8T<43ϯ=ĭ I^1-.p ƛqSBYh8qCJ,򀄅29u@&WJnyd69 ~AP W\HzhFn\dOGޗ_KL>,|[#K-M=@= W oi`r8,7?6ˆ_u.֯f M31죲6?e|;|#gԨZ\VJGB?4=rn]o-ESMb2Ved٤/鿔A V.;ikQ"?yҠ?C"Zv\Kr7Ee/n@0 )lWúErX4ѿp+!bLтl.f'_&UN(oaZ{;n߃%;?A/[lɹ#|w ]>MfBKsQ$u܌s%\2U ™1z@X@8[ uVEFGH"?-)5<'1&O@qdu;淒 v2M\LUWN4ʎA:N#X}.$sEA*h ۧ-ofg1ySXpv& \6R杙 b:n)8|y^m.Q5gBtfM8#C§ⅎ_`u- GY_66i@WZ 48)͏7e*D԰3huKHrH|2>-P[o\)ZaV5bD x֌~dʇ"57-#|ݻ|u9S}= kOI=U;5?驚' 7^Nnu`r>_o)s3j1iv}z:~:\]{ÃV =˧jkʎ3ZkO~:o_o/F^Wm].=ݣF)N$շӟf5KLq)gp=mܟ]}]K|#[cb_!^Wjg>ˍ{+ypd_oXezx:rv??]_Ul1O"=5B 2Ad' >|ݧuk?jkg|-s}q|:m\d../Ϯ_e/O/?5^w_{v+s*x<-~N.wۧg_{oyݮ.սW~e:٠7wͰ^Bò7:d$um.stx~V:8]_rgYB;q(rw}uF)ܼ4gOOO;?Gם㐽떟U`՞6{uy]smS\m75iC}kc`z|x`nfs |e{ S8zy=jtޥ.c- iYjOET8wy~w[v/ cw/zl>qf./tX%0~)HђI"\ K*rtNϨIFK OFǏ;_!{jr8`)l&/-y?Q\.ش5EpiURqk ׺;pWZڣrތ%|^~??vήA7dw.My$\]/OgO{ecs2,o~p~'{$ҿWqpv^-U0h^JY#ꤲ$%yq] ֯soU^([ =O4poWjk߇~Wnl+|gd\ O^V!ܴ};lKXjOs4O?>ӃO !G T?pҫ z|{zqxsx{#sS`;^59ުd$^};᜽jШOLWaKoL;rGnRʮ17 *F$ݤ][>#*`mv@b~uԸ|~D&Yݠ~uXc"24G8~a -BL`""Ȳ_FDg.ۼε~fy\(=q%͸^^]`$AO*SwE96N{/*D$륻_D^G^V ^J5r8:Y"ghЯaܗQK,Z1.qTw*KVCm?f!Abb,Ƚ'|XzvpM{hRA"ZYMEL 'h|V)i=dNۿv0y &$5(j- v$;LQJy%;MiR2"+>W>zA*K4N3ֵa_5nq?B.HF;NGpRf\yEͱkBEG"_h̼u]-V#bNx۹u~peV*ʮ!@K a nꃻv՘4 qrZHv'Xxj3!CUy,-Hە۷ٷV9kxQ4N[}7֫o՛Ԓ5]R,BGVh ~2zԚdE 1}踷P0)C>,~Ln&qOÓ岢xI Pos kFQ6:F);YO;HUƚE3M&2hk$] #<؀+rKGx֗-rb֡"B& 3%y*Or85?#'Gߨ5!_N4tBi+VvGX (۱b ?Vс " :[IJ}9 n~ǽ.K,T ŠI6} ,k7oQ'ft%<$`"aKJх1 Z1]AZEVv|>-L @_7HcP2aèSW3 F"lwB?x&2אaU(y c)Hi6Bj]Fk EU5--ֳgTviG]>ᾚvԞP; Rved]\)rl LT!+䄰t P)t`J',$?ptqJ:XH^Y޵u@=!P G# yz` k^ƝFz4 oו$[nO#z5 j9 _ ozӯͭݽOO_^}.&D^bwcx׿7w/pZ /!u4 + kk̙ c \eYm8&b53CH,"<8sV"Ē(,/;9ї*j{CEEEU_q}SțCLCiI $ݯaحaw{H2)4q9DYKF*C!K8%6쓈 7=~S2 s+N  cW ɓlb  ,+S4o ge?߰6VVBgtwbHzWlc;Ғ^4e GnZv~/k'pMHJոnߒ-iiɰ}6OLJ3MzZ?hڭ퍣͓ٳbv?hV/{͝I:I{\\z#.㋉ox55 IZCݥe74YM rELJVV}y ..(M*ibJ *?'ڊL508gSYC|mN4!c&15@;{L dOUҫի #noWzAsp6/f23`S/Mנ:Bk2E^ 5V68YQsCKS8tfbLAe)efC\.ldZݺ?5oyO+qfLNf ~UY~0ehV?Lh6@ V]1j/')='`U 맸K+tll~rzq V `?(ĦĀRLn@zցeiE/P]urNP'D'ҹd^(0^SfWqG^9ښ34j-4NG\>CvȲ]X?S(A!K| y:Z"En^1Tl͒F:{M>nu{C\+%Ӆ&zmmm&EJBtn&vϱ ńx$NK!5cqڒhK[-x@4z^ |(=k0]aH7:6ʹo2*7GWrd y}82tu|ɎϿ~7w;GQ{tu}Q9;m]v\}|y<:^_]6sx﻾3mu/ד=8.&dPjƦ}u囵sK aOӫ+f50Dj=RAmQJWV6bLi `''$p 8s: r*I%SZ\԰ ?][J fzE'6!ݞ ng{D=xԽEBIlˡ6"[Z?-VX)M=D ٟЮ>o .AT@(5ڋ4(kNjCoE 0j\mr۷(yԯl3g<w]g^ճ6=긽]kܠv^b l|gg8րO0#yt3m>@ej'v.GE Q#@>>8+ rK($LY3Rdxryb1}q!BbFå8:z\k$=..џzPɓ5r8I,mI|O/o6iq9YmփZeyBF-Zv03gFq{kDaw:n~^wjVFw>~xzrvup Ժp{u\r͇zHO{٦{5on=ڪ@ @{g̷i{nz۫@:KǙZ=O{xOkt)n{3й~`7O_ϳ3I4Ǻ<{}x}p1[w=bKq#A@2ر}MrW_dO1O֑Q fTnuzl$<-0 |i(&LDNh9MЛy'qz@ۍY9\ZynΣ+KkG +͊ zȖ> ˃/VI͍֝p{S/@BB1͊zϼ*4x vqwTo6ʂ:ٸiZ^ttD*!]}k=Z[|8~ݪ>YA 2DkZ&/X #;n7uCV'&}:LcoCS[zj׻w^_+H6ts|Knq:|fC+Á=:YLd^8(Ow6[5GTsQ_VIUAѯ̞J&/K*OTOQD'nkG3 5C* d5BPLP!UtO"JTLL(<)l6Xd[FbX&B#<F`Қx0:Szd!spA_nXvη\ʀ R.l#װ X=ȼXT.ά+d;&i{_asV7VBv`1c5=( 7*;`[%UwA-tcMcO b'L9N(1,H^ݨwGHȻo1'Z' V_U;r&B^4[Fwdsef**mCa:L܋)!DG|9la'Y_\L[attNec{\&e#hF ,mUӕt$Legàb/H|&/w~'VyZc] [5WjD ۊ67+8JZ6 @+2.K\2;#"°ճfTːr`oYm0Ѐwf%vV~jsp&$d1b}?= intg<6]Peo=K㊒4G*@c3n35bLwnP̑٤Pfoͅ[~ku2i}ͱdt9B~|71x&͘ Āxohe^é'ZUܱ-* ;,h xrQzPe, 0Kp)$7NB{x'U7UUoxNz bǗg\03g0B%ďc?GܞU}h߹+*J) 7ӍÝk)$:!teP{5:xn4V-* T{GU*Zh }ǎLօJ2 @Aәm5_^,&2F^k Zhe+TYl>_Cӯd%gݾ GM D_*&嵇Aϼ\H$^%T2FmZmIm||Dpgʗ r4l6DH;Ob%[R‰Dŭ ->󚔅Zf׵ri5D m$WΚ~j0mbQlt^0ZBmyuw9W;6 לW;ܜ_ _ROC2㵌37|ooߗx${5Q{(fLIve:荀2vTzc$LAtomUoq؉U Mi@h^g„s< "i3Q&-:7'Y\a&y xQLRu@lAIj2_Pˋ3v ѽESXqTP2Z >9j>y n O)<"nCxL{d:QG~S'8!+ARꤲye :xAA^|bUևt9# YpYSZq݃=gѯCgL`FvA0<Ct EgWUZ YdW0B-j{X]^l~nod&!Zuub6sC국31}J :L"m3V$/9EE6$De}nN>N*@D/[< V*4JhuFvQ6ĀEΈ"oRr 2;B) F~>n.g|aaqi٭kDG!¨uc_j%I{ҷ#z(#=&.د:92aO0x&;0huа# c: ؜ۗЬ#, qYa&JA\Є.ҋZ e['a3FMpC1ax뇘f9JkPIcwv Gt#,׽oɒw}©$zjno\a9bn]&1O!qźm 8d=" ~,gv1'Wl;RK)R 9ڡP'&*!%N[IK9KFЈ bB3.HFL;7&u34OJyfzKNR`?anqexXaX5Kh{ |KA+e+h ~p @nژ_^}TзU%^HM ~-A4h 0#Fr_Z@.bל[文=`Yfo/f0|j1vc sL` /s%2kh"gpZeV͏r*RˊLg~;:g̩X*%Wc|Bf5ݧG8[{;:Z#pwqEHWP9͕h"bg' :U+rExW:Aegӓ`Z +r.R6$@*H$iO3j7 ʃ<-bbcfEfL,Q̵ƈ RHIژv!4Ž-1 Ý@h,t N.SU#LUg5YR!!v12G7WiuOK5I g9kMhE# %&Í&#!N239Œ22?>  U"@i %K39 2BmJ}tށ4 E5 ֣g/6sB;3R+,͆Ka0ub`+vi7gE/k5^K\Z@¶Qa'H Tl\<95:n V#'ˑc6*l+PExxRT/s]U1֘Gхf; y\*È'=`.}[`^TԲ<+ N5CZIcޠ_=կ>+%d=J=K/-[0m)VWnY[wD 6b Uɾ= 4-Wepf܂"x_<\q!~Qߚ{H&PpЍ޺zOa8ADUN/՟`b]Dg3o= =byЮ"/ '~lFSDB/D/̨N 9bzaqx dQf- z6$MsǍ{lM/+^؈IV-PTbʫ@fD 90y# ADbpx?ĞF ݢy>_Q<)6k $/H C h. U\ dY0iPqhkX'mR,R/1JڰA +Y6]TVu)ҌzSQ]^re3c#^ƛ7@sR+gQd;Љӎg;)D&&< /2.sp6mLO;Sgƒ4 ㅎcd~ּ/d w Cb>LջIvFEus&V{uRkz׫P1 ĪM7) 0? ǺI]/dtdW ,Q ,nxS(Ohdf}W_wKFQoʩ75.f)C&ƅ̒Uvތ;Sfc%PrQ?AX4p3Z vb5fJxJDŘKB?. >3jQ'JR|t6Ov0XA>wɮx&O"B3nF8vub"UǑ-E?'!ɿsC┑;{O(ВdxI"\5&(%%:<1oń'8CNTꊼ>1&AR2r00n.L VOX6-km8txd7[aOm/ȨUJJA 0>ImT䂶4/3MZit42#VA|G)n~׉qFIs1.TI#af%F%mcRk+0Rz:]D3㪭< jQ_@98G/%l<, ,a{_67)+ч Jrku7EES 4)1qFr$R>gRܙ"*^5)L/KeC)=c bQ,LU3'pi)S54Ľ3knL6ئ/6[3h3-c:$BяRJafQI*&5V(ɞl114-XVtֺ8=XSJ+cRbK|FIڔ#;Z9[[MgxQEaV_)6e$ǔb{gA-XI 8n8aK VP6R?aDk`?((yUcU5x2E@9zL&N&΍f悍(Xj(Ez'Aպi@#>EdPF{r<4OFg'FALE AǏ2t?ʩGxSv9HIXiMEѫfb)&39WK}3,~Uܠx1IaDX4{yϙS?w&*cd)>j+Zmet{Qrixl#5mG'S^iCұuOHXޗܨD@ўv/࠹8p *Dqf8w AɪҰF`C׽N+xud'FU=cZE`ȾἎ[rWx vle[N2-);J eE =z8kd=S7$CٯC޺y,cO&դIV88م[!Mḉ> qVs;n@lc@˓Pݿ^  ~-yNZ"t 4L#D%N0zX_,!ΈV*#; WW&97M˼ Z wl-3p@ul["An*3k˰2!TKsI{$TC~]S4𣬍:~0F$c\ҍT ,G+A7ǦdU?Vh&@SOβjZ 3`QKN#ʩ5g ec(H/Pޅmٻ)$#S7lo"]i Kcb[4 !"cظpy@;?l":yL@varI$)u*2)Q8 41l{sQ03h ݊?dScB FA=wo~![X^,2Q^o%8uBx_Ssf&GJGØ?4wIe5s , sY\F~MZUZ?u<\ ;׈|*Pvĉ:טV=67HVMQ͉ Jt#Qp;)v&)b]imZט#v7¢]musMQpu/MPx9ox_Zu)^ ņA:Ζ3K4APN91[0 BmNMڀ'p.{[ (g*% j8Y&!v\$LBz5(Nmz{FM/?Q  >oyDshÛg=m!FV8F6 ĪYf{u8S!sK㼭uZ L@}qAHHIT }ZM'qx%fEB6zE)j֟XBx Cۯ2k[sΌW,m&)#D8vkyTfg[9%)]؏t8( /`2 W$VɿuKbM>Bb|YPAbu#DLcwaV_+޾MH@Z3>p(FɊ׺kVWldgxж[tY ߃M=%N}oA#޿h .=w~z`q43#蹩f 2ămZWIT `(sP+h]]/l!\_)F3'gIB֯L[CҎf#/ 7cMX7󢢀U`JAU'uRDfa+O"| Ű`Xm)}GDKMPۊ|~o/ϱ #g6u#뵀vp >7W,s\>'q.sSmhSFa/j!. t/w`M1bot߮Du޾} Ӆ͖lڼwlE,NğArwVar9[jTg_ `XM SC7 XN~Z#a4Φ "OU+ Hյr߀`aeAY6:St{=[mOjEUI,V;,ʹyz z*,=_nψrHE̫|9VzNزaR;ّ"D r5'ĕXjGÞCn$\3ia;*IyjkZJM`=Y5O$Ķiv+3o|^ B& ^[/ty`E3x_'"<) S+Jd*sx6DG9ʳ2x: |履^)т86 c(K*`ՠپT!> -AʍL2 y41͉$q>AGx|2иB,oN Xh ÈUZ4=DZ K8)cSC8QD7@8t8p(2K.]xC #&F'n(_#}:\pM'jV:ac&'t̨P,&TW'[JIq yh}v1#}{E5wdS{tl#Mk._~׫D+Mu<4i[/UŵٍgWF+Z,c|;٬|=ڱqԟ`zV]L1%ňL܌;~urg0 lڝIb ve ̮mZg%[`OmJJ!e!pSJ3m @jTĄ(InRvzI_VFjitd }6M "@-jha*& 1ļd2lL8Zϻ-U2H]Ng]F)+.w\DWmW8 //_+҇S٪ M7%J&gނyA(vg0ӳf%tAЮZ&SZ׽ӳ5;_Z%u hLWbwZx0K ߗPou9zzmnb#įU[ڰl:ai kTڭ8HuA>>qoW6K(~'zE7X;no{2+F),F-`b{AJ x8C4G0ND9JXX&w)];=/y *gi"F=X>y-Lt$hFs*dNa'R/bnoD{x^ŗAX5~኏gdEbAZs6F^h>&i3yqrR9?8?܉/EW4E΢QLT ixK*a`02hw2uҚiT%ŨF.a 6}DƮ_0Ip'p'dd6Ch&lg$Bp$ @ H$R.z}=LE\bzXjiDN"mA_v/7Nv[_l}.|wsˏGb L cxJ}\ۃWM ޥ&Y4A#!e7ɉumXǸu X.mY0SltJFc(pkBޘ #Cg? $ұ ""zĺ#>`yg;~'77(~XXWÐ_ _6ULf>ڍc.9J.!}rPIm2hK)?謆 8!)1qcf9% k/ʨ-}(oam}cON F.E9fuqrv}wg}B4` aKc%Mڢ$I>?C1.F0 t19$UrL_`14_gW51Ɔn"17] g}N:moV|J1;42cyٯM@p&dKTVȿ$+e9$\Lvk1L{6%)*Tc4d5@5\dϦx43&tb@7xL)dHjs錏eޠ^5oSG=#G:fF]2uhS'l[l\Q5*A=:8ppJޮ*b*?C}>Ξ}?>:8e-كww?Klo= E!諵ca RTh1xI)cӰ\Vld4{E/&2N|p"%n2VVC<+Q0M( r|!Vi=n;)*j˙zœMHpr {Qxh'l s1NUO\1M'h&\~ڪC9<YD1Ѭ4qBCoig~앂 /G[SP9HP45Z)·'mKHPZCm9 qź# @Ez뎤v6>O>q>[kQdke>vqVz~̫bG5%G[6 oo#ł9%=g_LSĆh64'n儍1J舣,}L WBHJmVCRb[Ͽcg(] O{/{g>!_4F/iX(( `Q^5"V+pG Ɩ*ju71$ތ--IJ*CJu'`s3/ƹd(%}0'#w_+uoFt U$6,ƀq5- MI*@Fۨ$Sˈʭ$gwڷ\b9qj$2/)"C菗0Ah>lI$;$`tP5),k 0?c@)2k+ְ5oGM1V D ۋun5p=LAU* 6E"^Q>fҰ1&J'ɐ:7M|ӼqCt9P3{͋Hx`HcI5b:ݬN Y'gE;V?QjJ06 *ʞTsr.S/RhxPUp i66ă0Vp2W`iŵmfF"{/W4z.In; ]]^papucR:X(Cvq wRs68*F<SF{ƙI=1GCBP/$Z=̒=zد6OJ hv>]Giߡ( c[au ${TR z{amjcҒKp&/NH Rs`hR^䆃L Ji[WV*Q7*E9Goj1[;o0@S<JoB4C "l 83ʱ52ak4b_RғKR旌2SNw Ll0qѤmoi![lɐkd>Q/7q^aHn\) ɀ< xs;gjM:;%[^cdHetlCi0f0e4z~ř66?˫yϦ Iq۷hX 6GT.8'ɢfhn bȸB{qqpwLFd*I|Vd'Gϡfa)S4&to Q&g6haRKҽq|+*'EԒHr$-9Neބ?侵{rk^.:Xcޗ_y?'W4G'ҳwTኈ 0ѸwįWbtع3ϠuC@AyrzrpT=;>ܩZ`5.>_;ߔVuku D&bZnJ31E֐u<6%.G)`R k+Qn0}R{e~.ZeQ^|e1p YR_8*JW/bUz!wP˙@w#ZᬬE[~,|4Hd(X@<jhxŊe$1 _NlNņeSO:i͍^*tvdI?C6͊f oQ|"dqxccO Dj-7&S.f@F&@x4>{i/HO% x2ܔ ˬ}⤜/K<%דLqf~gN*|л!ZX _|+ş|@sgM|6 BQ:8ۉ;V+~& ?ǁe `>CxAFHp~Ƶ͋lK}WƅƧЎ3-əFl`45  ,Nkͤo7ѳ ,8LSʰQbh5}vvM_s#*dDø)[̢̘QRz7i\RmX#b;jov|/ch{yJtGBC]6A$ˆ|j ׍طsDE'e,~fOlí\vtwy==*֩ryyΙA j?؟pCp3i|  T2ϊ[-ۃ0QXB7r9ad($3fD&|^ W&6пb6M9k4.U()HJRS'|T"Aԯ 4`|Lg6`dLF"4ӈjL܈4o|NHO*@7i:`NZBzx/ė` lO0/=v!=I5]jYW"kMkR] qET ^4a$JA!-V+pE9WU#̊ˏEC3,vmR+}̦=e2{p.TՅ uL]QNSORROvdܧ]^]S&p"0^\cV 6Jt|I3¼@d+Ä#3+cI4y͛'Øl96&#*,da+ê.|:5jQRpLEq.E+}$deH$xILI(Gw6B3֘IUcoJ,[k| *XHx$*%Ҳ3Q[L݇&zVXH6׃NGD 6NP q&tbO7\.w;~ڏZ;EV y#pe%Y5$./BР@K, Dn zЛngt|ܑ/&I6'R.iPAAL+*Ǹ|$%E(pLm+֮% vc+Į$^ŏw̆ y~ŋк:7sIP%F.A$%1>4JTx xh|HVbe5]pEd9QNeTcvrhx7AЇq #|`/ju1B½_W2ޔ9MU%v5:I/ VL1 Ό% Y zVA*+ `>!-DIӐ2k;:|?q}2Q=x NmL`)?-o"τof ;Uבeo-Te t*)q\qoٳ(ϔ;Q=D5@!f%[! LŦP=Ĩ#>E&4Rbq: Irr͢xźNK9tt:9TA A>:Ƈ'3_GVQ*nffNQȕ^=4;+{A<4zV!'bm PE=0>7?/j'I"xzH ~F$ܤ[#TwT **xx| }2gM@ 7 0Tx;;S_+xOeyJ%aBB" BҪIWeݻQL_+)_ Q'tHp! yӋ?2sJ-U .o,`$vl4(V!#A>Ф sѯWs;`f%!u^Q@ XU+`xtlajZQkHA@ >I\6]DtTQhR3CnP.}fK)ʸ*^ TS6Ϯ]bcj{V 4GsW4hHJdNFzQd!d=h^%;%WN~4RV$-ͺ&lAyl +$6!~*~k=#& IA5}dfIEɛT!\K:dm؎ݙ6dlM+\vKz}!g8H-߱Z1$-ZɈ,K`EJ̣tKHWB]v F̔l624Ѹ] #r ze`b~0 l/PT^o8Y\uR'B,mWwNΫ[G{[{Y!c wlNN>鎨>K m䉱X#=d% 0(SbM '嬮q砷Wa0 +8\rO-̥K(e rU6SFs*0UI%茛 5_̮3 čGl3OA-$VNxtɦ|ưUV#ԉcؐ#cN}al6ɂuc?%F!n2PUi޺z}Wa;Q ].$  [Do[*g*JHсO;$YM jm݄ͤz#؟BCضK˫gW.g)Q}N /"H`9/xqZu I95Cq\/90׌ǫoҴpf7w )fǻ0ح H.fnjץN(\m(syi=iZT:UfT`]] _bC++!rE͛/1&ۂ5&%Y C}_g@נfh:slFlޮnbO<;k$Qi,+ѠK_g O͢擝+7؍h:xZɤDz隓4htbhz֔'Oqcu7 ѐӕHƲD Yr ׫W\w U7 X+͒,r!p|d.mS=ĭIgz'vaDa}JD{'=S$uh26N3=b4^z5JO3TM@#Q4*M}E_Ie6@m^CqRU0 =OTtcV pk"ύJRE(5fDA#>;<|Ǘlx)@K7P1jHeqTb ev ]gE[:COv FHmO >&~\Μ]0j: +ߐM*%AT9"+'"{)VR3&a hr_Grh=db*)v꣢ OsmjqٝG'w!zw] j1 Q()K֚ j,#K#4l3:4`lIOf}'y(+4]ՖM&/HKu9A :7_3QxH>rT?Q'˲UOjGSoȨ97ێ'ĉ]_Ry s'ی!%1Jd ܼ4P(T7ƯKϐIw)5UV.ר-$T!0 !Vh*z ƘRnF6%ᑂ# $cNc='\UP.I )xpkyTpjJk3* 7[ h+զTSZV6o? a Ṕou2)|/ͨ9{)0f+$0^ҟDt.”}NO Xغm>cRj Q+9J6gE2wEn__J:OlZڭ]ٷR?K'nއ-LW!x l~A,'>Ua*hu;hC˰'a30 O"d =C%ܝRzHZ-B7}z{Lx,%o[eFp>_Ǭ/!ӶZEf&eJL*H%K0Ŭф}?Y%}y@q3I&.M*šaw#\S4S뼹%JAбUKÕ= _}Õ+Dʉuټ)dc ɇL&ޠR>TrFd`HϰkR f/Eŋ-ATs39a0m| W>{~8󲞘wzbC~ZzDcc_\헨:-DAlnB6k N3) jc)GK9KlZ=2249vSbm sZ1Pn g=ֹ'dP#,?걁,I^$)3D59Upx(8_}^㞼3ݷ FiޒF6VS:!V%:\W+J9NF8i $N VfpR\;)(1G3SFLJ~icV*z($-oS)fCč6`cM/cl33ǯf)z{j4)AclI4S[":[e'"1੧K@h6z21vPRI/9sܷJwQy-Ex^:|7'eYF!$t&˦#Z߭_\)RkV.Kee\?<ܵ<_YPvYOYT3ki='p HvcX*y=\''u~P DݦqinҺNdY˜ 2E]E_0}vl 5ʥXF=aF‹R劂rpW*,Z2\5J@/41)Hq!ޅzهf)"4È׬3f(C!8<£cf%7j#0y dުΥ>$7ua<$Gss243NAMfL:oNJ_c?GkV Po~jnmj3 !њ؆O f,N&@:Y(2&>T ꪢIG)= Fha>o5jMrf%)~X)ݲz$+ʇ S^E ُSK8oO-3 s჏6`"U}k-7x]2s삃l|0evoھb9d=QLo+Hi20#V0[0G$m*%&aD&f&|PίVbkW{si9|?H7ݸ+~ĝԍ+;3Z$n-3S07ja?8úP֠KLN|NFMupeH͎Y֘BVSK|k~-5e-v{.{ayw/Gq=?]kG.r7 Zm^_ܱ.پ߾~^\Y˟tԪ[ϻ_^.o;?/Ii(ֆuqhi(Un+!zkkw"oFt4˴viV#]?n,n ^Ч/w߿.O_RacO*tԂΓFW'/5}M3%"xz.Q! `=J u[AX9[|y$@%-;߼wN{f܋Lnʝ83GS|3כV?oyΰֺsQrԟ^fZ]P5rz`WuW=$NqAU$3 ]IP/ 9*J>EjŘ$\p[@%!E_{͙+@(bn"jj*BU L%7T; EĆ+َD+ {=rK`s6Tس/Ȋ@(H\Gu֡Ps:: ިd~W7ݫ;-z^WӸ>CovWXG~VܫܫՍߺdݽ8 M8հRVRƈv/ԁ*F|2ĴL2JWzͤvÑsbϊTD B?"\|pVW\_r'jRVL^qq+R 3#|#2qYd!*V|)_ h77ZIB^*ox2~V-$.M$Z,{$YZ5iGEv!JzԚ@=_fK_݅DǝA]c>;6 y5h|u@N8$HOŕ{Jku/&t_v5{mF|}*sEK$V 6(lÚ!dYH'Mps"&T^0 Hsf6}eNy]Yg\1IphaNMR^9"TER< :ne&V8WtWӎ)[NYJLQL̄;V1^TA8R5 1&9<4\DVSXOuh.<{deV89YPoEӞĀAݑ%D^_~oW츇./vg\@ #3U⴨1AM(&?8:x tt%}caqhjc-eoXO-nmwdJ=q+pH@v,x ~< D1+ +mIeW.䃚?"@D]{9eyOr oD(GJy*ruj;XMDyJ>,{Hߎ>poZZ}nQd>unk"2ciCcj^ 's;ۏE;,_ b4`+䒏>>a"&a]mY`Z8M2= BmkcW7PRH/텡 ެwgY}4(%Q(Ղb4ۦP\n@ڤsSqe,i.k8&>wݽb ol+17|D30-@6lL l5EcO'bG>*WeR+G1IQ]^7T@'^H[$44w5Qd0{:);Oc'D}slZŌ6 &oxO!IhY$v?i3#qwSwOFAlaJ@TYu)iE-s#k HE\ׇ55!UD^:|,{7yBdğ[B+H~dZj-ڗ EdhP?kQfU\0guG7CVs.N`Taɐez}m [ih<Bqk-gEMMD]j% <Fe_lG]1oމ<-s@vny Ya++޹+ayeME=0u|lW< D0i"|V:;bľZhaMEp2A`s``s9YS2"H 0c SX^̉29Q27qY[z؉* FEM n"n{gh$ krP/ A0S o9m?cɘs*Jh&8nɽkeT7C'<09JEau›BhP.VN4 {'w\q31sO9a7=SL&˜{vFJfZ<3K&2lD8OpDK)+~RgS`hP3i֎?kƦRt]\ׇ"E]Fг3B6˔hʥK"tq"2dk=k-̽5t^:8,^zN &z1!ba)*ieڢ\{ҭ#f"XBՇ^L(>i"D8T` P/Ę#]D @zevc96'<翼Z\9R^7,Tr|Cv(9b19bNJd)y}[^?=y׈aKn/;0.Ua 5[۟vR蛗 /YY&/WxZӳz>ԁY.N^c:^;݋?ڤn^nЯ^^-ms훖$(e6/<ScbDh%F+Bڛ:73mS KOEPd?9 ? oTǵU s8VFBP&vkEaИ$^LhL=*>w<(ݪ[(NghwwYV˭b_6uK+l.ͭ_+| ;@{3km pEST-EnתBWÿqB7m3B6N\cN;D,O}z=Wk7~m˝zU훻/GzA֙DYpo:9o^^o@uwmXIn!u*{#{{COpZ|zтBa(JTɞSBڦwpI AUMv^@EؽHۈ94Qo*Is.点6OngluӠYpiYwE ^\ |.%$i`P"]cؘ7:质7~Mߕ`BLj"WOe> Amh(:8,Ć̛ U+P(wS-'vnƶMs:*up53lr | jW0v|\{>m|5OsKG{GZu> @en@NlY<1@WjQ)EQcA$OYz S- TQ}Zb$̌e/3*UҺt •Nlw$WO4'0x~,\d WY^(ڋ0UV̞F Ub Cb,lY3\W|:bܔqr *.:0bւA~>3?(qRa`Jʞth =fB*"a}l ۂhnLJ4L9!7_츆лv!Kzt/9gг[ԥeՍEUѪ5))?¬](5A}d<û"ۧM yx4sg).٭ p>H]BJ75`6hr?3Xk'.E=c0u8|Jf[d *Q!WU}  |>- \Ȟ ճFv>#e·:g؆@H <2'\Ԡ6wŷyp`fЇvOwؚxohttf{ۧ7eT"d*Ŗ'-pGj@xE]xz}Ԅ3Sֲ0  u:Q$%?i aV8Ɵ:lm`:tg'3Ir-3kV~9{+mi]72b8`ۑc9}OmeH(=Ȑ"jxygu^?!rB mSzS80f= .)IV8RtvtC1z%sBo J"$gO\`h,*bVqhZ(:ŲWƂ`T-WjB0O(89iK~vJ@n_OHIGƛ#zpyR -;Yޓt#58#bu˦dWS$ǬtkOYBv>i÷:fOUP$O+ $A&|c?L-.1Kۻt CCJ\Z{Y/f}o7lȁF۟}f xs kԟƕ̐YBjWvRa7.؞\44p{;]>n[.O[uE铆R3ܯULJ'l?~:8C3Zz}%yPlI+JZPYA$eKBN+~"ِa>dU^ NMs=%meQ9 9ID鸷 P'i +h=c m[sr@JR &V4tDImL`B*VRxx`)qkg؄.4K$WP /qJ(L]!^^&]gkT?IN^}54n'_n=I~,37SNJ7 mW3PܔuR&WA&/mNYJCgj~^i]Hom#L_N6hǧE+[A}][\Oa3:?bC1vɂ27^=f9hf!QnFB}C^ND4h1fmmD 㓝eVA bf &*TXK%MkSgdܓ*'\Pk4#W#,6`OajOؔf3A懸܅x (B4Y ..p/8:U{^܅HSe fl}Zd2HĉEhM̑0l'|K9P,u6MKí,[;7fl!4vt-/)x-@ge -,IAz|f'ɏV4Qg*}Iꌟ2z˿Q1OlM]H^rw+9%\K/7+fte{r%WD%~<6F33\ܤ,6^A'3pΊ|ݚ  ݝ7ƤdZ#?2bKD^/K)[3(mC Z*P \E lf>Ze$6ruQ`W:Tsk_;{['٧MmLG]@AmiaL#H:BTÈ<$lt:v}99r%32S{x& @z57?=|=gvZv!M.m}lrVszRdp{v V&\µۼ:*eu"f0)WA,if\3m|)]/9j *6;/؞Xc( D8GO[dk{[?"4K Fvk:ݝ| z!3A׫QqPsʼnaB  '"[І2/**O0YHF3&AnjVf\D|oXz ٪?,ti( \VťQS9SS&*) Jl-P  1ky>g^J@e-(B~q2MS%K}N^<piLC4zlVSO6~I3r\قx ;!·uE $+2* 74^쀥pҺ& L]JՋJ潽% h9b/?勸K_|ii`Ia XkR.̗T+> >U@:ڀ iѵzDj0:ҥ:*Po~yPF?f{6YBت܅^ Y<"yg4^0Z5[-W*1: ¸Ƭy^m FCIL vb< 0ojSyZƗ^mqu*"ͲЃU:^/p(B[YO/:gtm%eW309yVl#=[/-=amR'j;%lHS{)BFnMAL5 ˭\0٦rԌ>}ncx*N㐵r Lo>SQq&']ZX3c3&ӽڧ ׀OĥigS7SzUSR. T{'`+F.cni|@9`d`Pqf֚|75OQ(hĠom˛b:ݵzv鯽>0##jaΉ& @SZ iۦ,TBqƚdwZ$Òr?Z͚#AupuԔxK!I.{M=VT';u󼠄? dxX|Y6BA]sΦ̏L(E^oLEYqBOiBׇѠۮRT֌)b֣{!邲<lL,Tf/WO OY'm&aA "cO.Ղev~F ahDc%ݟ@Hwj{@;T$Cd``h#ǠPW{!bQVYtgB`U97ISP )F/Y]Hna`̮:kϢʶJ uԶT4&U|wz&~>ucYh5k?V5k>O#~sҞ'8Nf?g*p=*UYi@_CN*,AO@[řQkc$ ߟf?eG=Nb`rFT 23X0`"=1>&VEN\ՂV4n6P=!*)HXUdKTWld7[y_\^FOiFhvnVC"XUERs{̀91@ŚQ13'dcVwF<3@!6{vȞkfD̜i%D (R+_17uVk^i]CՁq[.JD-<i j%1AosYG5PF~^e4;8c*ˬ8XHjRD#(HI&םl(󰬂ed"V5F/zA3 oJ]qY+034zU0‹\*"7%;DV5*6KvN ij)HHdF T [u]D}%}amJ#g[AfHXZJ0 D|NiH^ܦVoMow-pk >:x|olTk g&n`+EDHW!q^YQuVR(-נ[k1QXəgk1 'u\tᐉEzL|5!t .|FD\J].3ט|P12a]>\ .a$h6|֠?L%VdχL#;Kiм ()C: +F+~\e^rU dljoQ(a">vJy3,zI~V\*c+52e:M ~ p!i4.Nlɩᨪ@$"r<ʇ㓭3ƀ$#Pgx h4{M:[Cs\G6p+#+L$jps1tO\4}_OA͂ "h\',hu[Ct/ "~ANI7ME*zہ7b b\`(Z^R+wZܝ;"bdIHWRu -U! [9M&;fjnoTwOi[@˦3'zxqZ.2 ?Wdre46kCXk}Hfeއ$Xzn+E@#=;{swkE]0*<]()qO# Ῐuf{7P jo܎oQ~VAdPA,`&ט"  i As^¹Ч-&L+UlineT}mlVonXimxAX[M(wc3+%vWRk;qWh5dv>M`!3Zt:P߇kcbAqݢ~HL !.QUz4C]o4sO0 RI;6@udTmM"e(\GQBT"BeQZZtf"=EWp-{lȇhиw$=hY-,o !NƳzzJ t<Ǜ8q}'Nʨ IHRՌHZ.V\U&#ǃ 6S,_ymJ̔g` dC`'XE=%V.`0`[t]~IDfK"K.;q43])9[PtY؝FL`?'÷J>oKdczn4=2Їzߐq>% a 2eh{Ť c1T7?@FɋX?vAY}/<2ep ˴@M-%{șM!0e!H[kfQJ1K7! تs*7<TQQ>+5ft!8O_N t~o}o]<|i~9{ZtPԻ^- nZgG?p_o.A^lA(@QK\(ڢ~gX? ~bҾDZRCV)'̀p&b6Xr~߽,Er֐<2FZ8Sijquz|W(P.^eWU,Z#}og2תu^ueg@fi׋š?Q?/-TE0v^:Zɪbfը4UX4;>"5Q~px1AhUC5ߧC8j:'/8i)ϯHnO$ nr 6ɂ-ER|X>H/W%3nUxKd>qX9)l1$FG3$Mq]}?KUkRV,-9ӆEwv KnYI;-G_.Q_=?}]z?vd*4hCZRmF4%P`in^&i^ǽu#lJi)% {].~( "j+̠{im>FYYDiEk{}4;gݼ6iMWA^jR )"`v?rmn]ZIOIȯ88-k@K/ \6g;~1CRql3g=QƊW򍵛u6$u=zD~$LHR1GAaxuié" >ʎ Fseا=|H Y)2U*ذ#e|JM>/)`OL|ʟ6̣:_K^G0ҧ'{,q/z J5kbR8m],%wd;*h<=,@tht/PBlb PU ae5<yޕE4,UB+++V*kɆ~ ٰ{T 9!'G,&}7,V|C~=qfK+SXsqǹ0l8ʠ [DιHOy67Msp;+MЉ~W?iG)H C/Np=dW0fа{4DŽ2y=0?> "kشl}Zl᜕)pQI:`S"rށVL!,J$PRWffD{72dQBWrJnIWZWH}[D;|2JWf̳gp8C㘅"q- ҸCرu5g;O;r&v^R0`%Fw̖s ;cMp°)7422e-:B#ӬA 56[%fG5n_K|<:mð38qkx{o)X-|C3bƔhЏ1OoQ~dy;4&paܴtޒW:7Df*-* 3q ukL#a!8cm*Z_B ohӈRZp5zY֒_$jIZJ70'bY42=`b:3 [01/1F|[EzVkV|;;swvνٹ?ٹ?cwvn}zYjSi~+f$}Q0-f@ڰ%\\f)q5.t9 uCH$LEnB`Y Ŕa=v!eEDw9wK;5@ 9 O݌aQ1Wk<<+cfﵟk~kĜ.ټ?sւx4TRpF>%hF$(J6?PBзQat-NeQӃsnOE#FFUf+!X2we\m\F( (*NeTdq\>%Ԡpr=OM 4o} _al? 8$=a8զ$,HJґb6VH*ֶfRO3&vV‡ǽGѭY,nITlj*?hl7ua c(fſc'R߮-cΓ-e !H0}>dsۄ((Xtoosz0p ]ӺX(¤6֌+`ǤAkAd2EQiM$;ea|UJLbɌ\=}+qϾG'7?j[vwήe[_{٣sy;ywyv@xaIʚő7-rk_'7UQ-@#1: n:T߅$?9xI&4Oc%|=];Xu18_j5ZEd{ w篴{΍bDNqm'1rJ3Ț`YOe i7;k&O;Kk(L&y_%,Xbo^'o@I4b^0^yP> Ǭq7X"9}Pc(=vJāZp0h_Ib$G"~Na؉5Yir?y#lKM*U wKھ &Φ&$f! 綟XJRP6 QyMbM3 㣣 5n]oRw[b.N\cFX΂a~;h~[%1&D矤SdS=/ PCXI7T:ubџ tF]Y`B ᷍$^)n*g:ȷ`UӽndNq@jzr8|+MkvA5x:CCOoֶO|L:~?Po(iwkov^n{/.n>7ڭ0_.l՟> k|;vc'mkӇ/wmc&zxSkevn(`'RrcH3ӱ!_ 8uvMOBT$^xn//NOAdko4SGf1V~;FZ(zCO+Zګ8^XleN=b]5o:Cgouٰ6óA"M8SVv{ Ƭx, ͣӔ˽1PϘPbtW@+SJ4BrDC5WY\̉Z=TRs#ĒVe'-'Ս!~UZ2 FIϗvƲuRo7;4; Ca[*4[w`9v{ˤL[)bi9d7`k07kÁF^LKQ0OYL,i[/w6w?-aoah=AtPQU_[at*%-D3RߺÙN6fݙa^ 3(h:Iï^35\!^~.DfF[ЍGb`R=Vǧ_`5㈇>'_٩Hk4] ΘRRW?uա,"Dn+Vķ{A(%Π Ԙ5sV2&YΏOww[?!CUJ EǀvgPB[mLGhhxj{ ¹GEM OO.|GԠ1{Zwd:&H,6߹7cqhQ(f X_MV|6ۦq2賹1q1?H5ԯDUTk !/. ʾ2髦A]5Yr^Qkrb%X"g- LFD+b%i,-Tqgy+K=qE#,.ke4@9eT&^l[fπ`h ǔЮ1 J&61Q`ʊ&5/ ;:$ېEc  S;ȇcPYYJҌ ƻ³(nmiÊJ`MjN0ANQUS;c  K5vNK!e]U@ZZk&ZN֟5B̬ aY76ܵW\yՒx́Rܰ)ۻ@M%tLd'v{|uSiVߎ?YJX:֭J&@1t PSI~b8W8#<{/3A {k[ .N7#:hRTrl:?ӏo*~CkDYf5J? D|? 'Jam?=ܷQ޼;ڽh}g_?<>.}3-҈ūU$V6wԤ XW[}՛B~|???~^n~\%dnz:NޭaPvvq  *Me0xnX9˝bmwQzJMX)s̭4ӖH[*Yu:2 A"d+ʼn5yWGSOIa$NCu%]Wɏza^^MFt퐼~WAv%\+R6--Ud}G (%gUI(opUCG3xllɓDBmyR5g g09HǓ*|ԙ;7Q=ٴaȝ5o%%?(zz<$"NH+ 턓7Adޜ?zTͬ_SVijэWjv~k50`L%3c3XO.> ~C`Hc4;Q< awY KCVH( zyik'  %u eIy\vL ZpLNd7ť 6=Po:aFMiB9EsBNMPxݩIX-5\,vrr[~U9 ~U g=x&LeJ,_uؿ6O|߰|IJ&?=|Jg|Q,jF韬y ~:ͦCqS{3~_B ,7KY SӺa79HkC\Kvn5e!2.RBG] ]u.ԅ QB!{u!PZEo,Jza4IMi@*3,Ej. ,µ2+]~k4Ϳj/wm7>~/wZ ѿLT]T9fb"4W &pr*N:;zuTsLAEv>ύ8!3 R$~|d U%.Џ1)QN0&I 9),'.y8%/ӊ*l(3KUohޛ;?N;e`CE:0O9JYqiA=J݊Ns`K3~9)ٴ0n5,L N 4=;lLԻdL5jc3ۚ)^f=8*( wbxǁ6Z6l- mwFsU@ad,Hiڊ( 0e&,'i7Av`/h5oȈvпi`8J?3Wg|9'IG}o -A|m:DŽP3<"wg86~/4Y AI1ܑ8]ҁlM@ì$ʎ73(yneU;4em6R158`lJIӃ+(51 oAo0 o#OQ_Ջ=[pjhHa4H2rwz葔LZ/ |"UK#ІƫT;>28WFPe,\*G?R$CIFgQSfZm aAøvQD~p`AGEZļĚPŀfMC͋a^l 'Yޢbmm;t3=TdG+˪zxɎNsRx[:qq!HyN6Gw7?}%{~v~n:j{_~.Z>{lzmkshw QԂ?3FK9ijdDDŽX;2Pp@Uþs0e!NiYb!1TӸ6P }Ѓ EBWz77x1ulC_D} Ff# {IqRqȚpnp`ggU^wٍ$4եTƵͶq@N!5;7S4CpƍaӍG(n畹ՑnQy.pbCܞO\P40ʻBbvC6[bzn=~l𿅈ET`?cD@K^-Đɉz5;ow;a ^`|F| nubHI*MC62) YDu DE"ozMVeڡM!Ut (Dx_9Y$ى"3r3s ;l\ ;0&K.g`єqXX _%Si1Y8gyl3ٵUf682 M 9C1rsښ#3P"QāXţVclǥ/K/F}ܪYw7'gzuvzV&-L')Q5IfF85]SrsS'_=H1G\f^unM<⸇+gMB(, ?m}!n?:bw; 7݇o-i0n_7ٿ7S_|789$)"HH:jD奘s_>c> 쟵w`Yy3W ,C7o`67ΠRhGzoী^@8^$%YEN1AnTP"%I4Q}=E@)v^]@|#|V2 |h\0N/T49 qC?kH0KyD)luot=mM"`/D%J ߆/rO`{y7V7XAB~ŌD4Ϡ{l{I;l ްPt,5Ob+, Mcw$V2j4!C|?l4l1:fL[͠Xҋ DX kZl @6 cI y ȝ2lް9M@5oMU6D.(sq ^O)/C2x .IW=cO<(_w~˯jb>mG\-~]-~6vw_{?ey?U1VPCh&`HDgHPnNj c+,M_ am6npU*:SE 졽њA8 GWUnSε^T/rJ܀R@~\wr[a l}is+|:?/# @9~ߣTod;C-4L36ͧ9Ĵv#TcMj ptj_[5KLp`Euҡ|fwHlyenL+M=۟wv~4x0[*̫GUM =j Jo'G+2)Q&pN~]} 2tpխUډCuyx_Gl+j{̺{Áh']zrwx9F%,u3pkzSBp^$*EaeppG={ u.ӄ`q%,+Б~xߌZKxFD.[i-NX5P3C<4N^?'2sffh-N0:_(rn;k|[!R l j{Làb{laSeyinDŽM$R(pؽl[OV GyxhEI#]o><7G71KQC#$χ>p Q BK>cx;Kbbxϭ|umK9ē/ƱУ^@X3ѶGWZuSD٥{7zAhPڳQ*0yn=6:a]Ym"^F=G=08d$CNzsdͩ^Vhw* 2HRKl*Y1Fc&X($a딝J2L6wd"s)Jqv8l n^G&P>d<*dXbik#4X<20p@>UencօpW\l]]d04|y؏MNpF-truMޞ;< w3H{a.~4in64agn3GUg( 8֜ Wlf:$Y,9p@oatepܰ6=_"uݠV Iм4#s 4w`y]) |Ĥ`xu`\*Zo[P1;Z2R|B |ig ` ɧ;h{Kz<aoP'z^3DcA JʆQ{LӨȋa3y1σ\.Tt!y(`$4o ZD,ܣIL#f_UTY,,ZSFlh Kz'k( gNyRTʙgUe}g'[矌(AqL,<-5{;7{HWI,hMC@':a@,3# ~fz< B 37Fa aRKFHt̚3V"=s5մ y0HO2(pH܆s>ixThx< h] %$WJV(ꐰ6|\-=Z"p=v,`\;   /cC23+7w2h⏗x-\]QW6SThEkNgރūYy:L`on6"+blqGq^^Y _ZۿVvuˎuY]][kU+"CBugq㙘F*%VrBG6ƍ%Oa8?6;a( NuFoT ~Zm,ڃNGCr fIw*kU*xQ jЬUo1Rb Z%.4*N*_U/6K7whУfw%x&:JaچǴ ȡsϴ Aچ>"JPOOLK}).̈́L)DXP8Zg,ޙM8_*GC8T-gpV&ޞ̞l;!B6^Rj)\/^:h m4o-LɆS?H& Mf򓍥%g>#]yy[֦Oڕ]J2{. uu.4Յ0PTB.qR$h m}u=RvaJ0AC ~E!z3'D!- )C0K@(hmCQCS1&"@ fRD&i|PςÍ*Z'`+%5o %3ytow 1a{17 BSTa8 x,vV__0T-S>1ʠ˱EKhl YIgU gJVF\U}bJ>\t}'|3A*pYV̽sA9x>qߕTۭ#jCeH%Do')[6ħfuYB 6F+O{^uQ ꬢ6Q=hÚ5a߽ 3ϬGW\PĭOb>MX`z%ޙHjn_UFS1/%j -u~Jڣm֬T,ぞPTD{&(AWٝ,~-kyHƆ,unhK!璤N(0BY%FM'{ =^A 53$f5!8EZmT&kQ¶jx~I %G 4Ak.@ްa6+\osj6*ZV`J;hg/v}H&!݅JqxJk'Svdq, 9 N ꊨZzi\f"ۿKC|OZԱcmP>>%Cӑ|u!~^:w|bp5T؊lJOVYpWSRkGzTkËvnMK\H00l%605e)rz1ڵ)(Q<=!4f+[Ե>2eڊ?^WG.\-Z`#녫>mr y6 r{,J3,^!& ;ƠB@uM j1a|J5T1_F)9_ic9M/@8%+@γbhp/HzQI5\-6~,_ܑq-{8,.(TffJ-/R(g+qo^clzDz{LN 6d]0In^b]us*>\3|IG"ӛuDQ> @A943bUgE;ZQmmL ٩i"ƽ^VlM'wqIElXW5g6!BK~̨(E.⿳k'g-ވ؝a/ LKe7(%l#dGD&zWnZr/n4;]|ӊ`g7kc:9obSa8P *"rYlw3gG23Yb~5L&Ap u.ӱ& #0iCc(-\p^ķWǏV18! دvt9L]g?b`aa'o Lظ盐"nNW@{<Fu*n`Ef/߯liNy Tvd8JX'8W~<)HQfcE}9 WqDC u>4jM\wT=9=><9OcR/Y:8Vz3AD^q|IK"YXQtԙ#ϫD3e'_fVL4^6Y6ixsbp9 D n,koU0T+N A%f^d˦6ic0:#8E]e*LB~8_j>NGOΒxp}>q!muS=4;SwmohyAMMP2oppG4Cf F`oF^~TtoN8j4q)1n{=)uf`mVɋsPlg/2s[]]w+++r/..|>rxQt-R'93\9Eʋ*ij, ۣNw͖8w.dxTލvQ͍- M3W UւZsR> pZXI@ Fu8 8ϺN +}4Wʉ:Ʉm"`<#k'QumQgv!u L]u T)FyV"SRqbZ?QE?Sʣ:O"gZn::83&Yi|%npC ztGUI4.bbòUUJs4{cѬt-Xw,]_Uè%"Jj=8FZʹ|NB L\[BAq4l[VZ*X(OO}=U 1|w ꗀO$$dV8ҦqqÅܮSovpGe2zEJBGτl\!MQE~-<ӹ 'ݴVkG6պ)4Eaq nO Z4sDlXp!4ǽ0gA xfslp8Ȼ9`I=(:^6G6.jbv;=Rq=ON̊fRJv*v|RWrV˰ ;2[R)[ro7asv8b{ETΔZFx섦+-aKp4bE 1 TƠwsv|$e 1r*hwE1Tp"W=;_O{ck~wY-TV!:H3v-hnd3Cw!WA^^p> w`t T`tǃg|2AVtkٹF5_N).q^Ҍ.d Dz~SCSF]?ˍ] I2^H1 B 5F?cdL-"3z[XPuh( v8iϭxC_ "zOoŦJnky nrدEvK1q2W}ha3CdN겵n~xAsF܂! M1kN܇0s\aVDgvACT07aRrnw(#e * + yuaY]XQV\jE)}Fĺ0c;1,]B|ƭ(E=`4=I O[#gh@fCé%L.m(L<;~;qWp{vP;kƝw4 M| }9h!Ӡ]ѫTxi!ֻcg#h nѕ|VR?i+<1WA wJT|JdZt+UU5n9֨jx 6"CDN0"e|?.ЖڕXe*zZ%. Q7UAmSF.sfP2NJiSټt_ @Z{Gd}l?~MVoVףV,kSwN";wcoYP*W]g-^9vr~֊oAgi6);C"bg%([gς`4@Wo_c.JiֳjZ+y/#L&wo'iΘV)Q'+ ?Ȝ@zN)OM tA ^d1sEY19[,B*;֒_LnIˀ Dٜ$7A|ԀH{u2W"^sy%e2L-y‰\ډX_*Wfm $)#^XR3%rɆ^RB,$Nc&i"~,E,odԌr4 Z7&ֈ"Zb&49,a|۠ UWTYsn:'g y~cSU_7aL.m:( x Ü"' [!i;~\0['[';m݂'(# ЃjagB1)VDƞG!t츸:fE/vsݔHӼ%(.K9&Ytlt k,.cb-,U}FPU83Plێ}enoNdm`Q-5HC"pp`YZhأ`'ޅ}LCӿTt+2"VMr2mp-Lyya:(mz1Yf_͑3jF0KxݱX/@?c Lja'A/9UYp>z^ *=+n1%U~W;J|Q23d3>TNq5w4aW X[bdH2< l)\b?9: ,kS]΀F}@T"ns̏~i'y"_$gctG ˵1v.{`hώfDϜ|ȟfGnsu7 1B az6RI-sw/&nؙA0GdX!朂p2P_1"SQkiPn:>3:a7;;N{чTD3`U5KZB(A"HtSQB<0I֤Ar^%ʹҟѥTV 2 ]!By!fDX`䀓wOO( 3~krGNcż{K%t oP#n宱6L8}r bcOAD8vlO-2QJ%@R ~4K)4 楬pf!'eD.\Ɉe"N5>pD!h%W֤3pZBSo&rKcwg-4"T ͆f8 !$O'P1QdtLXP`R7u0l P ů7/-:$B]?D=%wθ5_t4;;;cЭ!]vd,~Uo5˥xl-W_ܿn _vJݷh01:ԍD)k_K O'g{\8lⴸ%Lj6miǓw ;lHFn[eG1azHuiv"-r> Kȱ]ݻt͢?0wR7͓ g+SH 5f0qJ* *(Jyyn<'xv⻌97bMDn\PoDRYşR]/iyM5r%{dSnZdӊz-lG-^lʩGk ;\+pTO&zȼzd~DɦE݊GqQ*:D+inZȾO#9zޱO]76&gJ޴gjk=pfJKhP-<L`*U4q8C3A?P58KEo'-RrY10A7T 1 t6e,j۔ÜcoBG">0ERX.jhhL0j R򖞚TY1N6ۚ= BI!|08g.)l,Gp6#Os \&H0υOsB%c[R Y, +gpa*ԟ SKUbh P!dEU(% Ru7|R6QuD6߅XaCݸ1\=c!HnϤjIp )gT)R7^~!Xv}wqbN^pKuӫocڿm}};y}Dý1n}t?v:{iPRIxFSo٩LU!J|݅VP3^%zzqa cJ/`S:S0Լ[=J^yHw L#KF΃Iih{Fh<7GȮ7F}}_84r1jf9BeAոg% yԱlVtКu7K{GT^~h܇a2_֦cPtvawr+3?PvNs#3UPUA2Q8ȥ_ote6ZYbIxtuCѬ{H=hU2A M056 s|Y mYtn7+f'!(KIi:J^ի 5Z1O, *fli"Qjsl%_^< c:qD$䰂ij8[b*2I>$Q߽t믝#v)_G;ZAv@K{s=aw6[|L9򏗨I-i䖜f T Ŗ dKrH.njV=F& CAJ6@d0΅ ,|ҵ}'$qGd$ Sb6.pRmXUMyY7%^7i|8$y0/)mu-g>8{{k2R N2M' bgTƁ>׎>ȷqg~9N#7T_|Hby fw=ڃGH5p$}75H+>fsy(%ϫ @jͼ"ѺgxvjQ r|*ɺu;ɵFC z󊘳YN^x$,.Ju.3@|R֡{&nPCp&4!J`N9t8[Gha5agXIvQ7 ;alN⻨wo󐗑_ IW/ɾf'M)=Q&xcp黉P3eVx7P07zC/oC`(ji'"_+u\r;f&~4?+v|{n󇏫ߋMƘDym}5pvkh[FdF<ҙQNzi{ }UPX.c]s NwR;釮Q:>жޯ$¶/kjsoޘM58ZD]/H*{uϚvU7FXZque|YwԢ$|Y]QjVM4[z}5m|{_I 5Oxl_NtPp}8F >{^> )C"FIa$sqzqɌC^ $0! }37Du#Nڱ쏫ɈӠIMf/h2O(:>BP`%:R@=A?TTNt_Rғk)Lh+ j=ثƺ;*${6ڻM0o\W9钜<а袋GE6&iOOƘN5+U=m h&8><'+gtƌ}вT=dSb[exCdPO6u,8I [p$YJz[̗c n~xȩiwnO9"'^N7mXV3/} k}"+*\ǟSm/7o|^JD,K4q4<8pl!w2Mm72Av˦ӣj&)W57B]n4jn G 3{BCC+,a\!11#DjR֙JAY@o  u÷l[n׏sPkQFB5;ɄBz&jά ?R^|$ʹx3IW"za3[Y pL_9z?{j[5y$av@55=%9M-⸌ZCoDFR/xuRޒUPpL(ő N@"fUMU,]V >VȜTCiP^1y2)5Ex5vQȀ+w&LV(/ oШm."ǩaլ; hݑ  !P|Eij+*ۢՋ ux-=q D㈋pi7B*,tHgеrzh!W67gꭀ&m 8g4u]43ᛎ~j YL|w)HZidp]'p+k=N Oץ9\6 Î`jz6zBFDz=k&!Iv `}{lm{od?֠^^L(2SUnƛUlUڈ,X3EQ s8%3 ] 1lǜq]^$.,4RvaQ0ip}vWlqBZʌ3޲!Hr<~-5_~vs6vX%qE}ΗOmqŗ/1gO]vˣ{ϻkާ/lǿsGbԈN+oߟ~|ve闣yvK|G?O}Ycwwr_쬝{_v`?⎝ywv,.bUjD>"]@TF6;vmyL/8\z ZFN"L[|_=7g&+X9:KEe xb7gNY9.JݢBA[`_*fLg ^* E ɘ<ْRctI|* &D, T N{"\]r@2( 'jK3- P\E6"<˕Nd~(31r[I= dDž-v+ hgLa@yi$ 2vDJh5oj2܆}(4IW[HklْArk/GE'ЫU5f֘ot]2ryBV&k;$4rw 83ܠ%X= B\YL|D'>I4Q% aKM#SKAeErZ+0isXa9Y0[{lDk/ҟT9gDTs̺K!wHK#bl Sޗg̻mNyu֮ΓwӼF4$L̛>?W 6O%j? bt(|ӝǏ"} ޒл[c5:BUꒆr#q\J;fZ`Fvw6hrоK)2ԃPF5FuTz Hՠğ߀IfL7UMY {:Vv'vg&/P?gF;Z|<>v3JO;o@ y6l3ۨJ }4΁6Ȟ.c:Lb$ѺoE ZKW/ݬG7u9+f8s#Cf B@h,-i;QSPZO(VfpDPKnDŷF'\Ԩy#G &yadID F-Gs 3!E4r&l|zw"N<ŹwMUG[K͓7Y|&՝E! w'LG*r%_L/IY{_׌3olztMOSXLi\DBqŸ0g6vIF ɂV[6ҚgSUn@ܧj[Vw@;f)KSKfl&tS=]Ɂ,zOQ$ht ]wl&c52a۪&L͏]sM|. w)FdɟImofB`2&' , k15 y^+bHE*ă`uHhK"~kEt%׽~uWaIb`>8#pc1V]U}˺:oRH)Bðj BNf;:kQѯϭ/O! {SE^.w϶wg0צl@="VY5NT.ޫDZ'duCugJZ@Uݩlژdziّ^9YV8*7nl%]"`ʆtEmxaAqzd&6LFͬ1)I+σK?㸬u0N8ƱU@$h"s?#CQosھȰ+QL#t~ xKխoLA@N 4Rl'pH[aQ-[x(HV+^[no~Ӆڋor W"honf#)(4JL/A7(%aRc~>XlT{ ǘ9f0ˁf`-ED;~tnP;TĉgY` }6GByaԩTcT/_s/@4SBH$bGM7PhQ$٬~x$\SpqSV5P7p <ֳNǀ☊i\vGɇՃ=™׏4AbA^eK5pJnx%ϗ4=BXh5J6-t#(l] :p6~3v' I`Rjc~PXuծ//’bԑIh` #}|o Iy!s @]y}mWV2pZoz֝ 'qzoN> GmL>:8_3o̯N&x Fr#Dl8UHtQ}$= [a0i>o 1k1 h^#KAz)a9y7<`&n0]d+;E:|KwAl7d?BIgt =%BK Ϻᄚ~EN12˚JlYGvGxr<8.O'?'>.9,#2]omB3Q(\|qݠ瞪NM6)ܪKUEZJA=6k 2e%f &q,*-2f,( ̚욉t]% ʑKz1f_ZM>z–o!6 6E ,Y(<[.U I!m6[VK};p @6q"e,"л%4n~^쇢լ}x˝HV͆'Q8[Q% 41&a'$@KCm)h+&)y3>8 bJ ٌsYѤZYoGTjIgs?gv<;T7?y{UL-H?,f0.%"ie.Ws툸 O^El68u?ۿ\«ӊe$y PEykA˛39 +Z#^Pޛ5jü(8O`ͪ Y UiҔ֖lL]T/ְ8))BIX>sB#iAS*ŧ{h:i`#̟仢՚]/؎n-0ȚH%MOMKہ|-/s3۩Qh# ~ dro8xqX#3,}$ҋ[6We"%1O9e^q4"n>s P0E0>^{(=6 >kp[{0sQqJLރ+ >T\23Pgzź&vͥP~̶M-uz3BKգӇ=ȳB;JBU]~N&jvN?^}\& ~YJ)ёn@76.R QpA!cN5jH[ ŸKU]?gЎjK e/Gl}*sTȺZ2'Ɖ}mk/ku q<(pexx0NT!fwP='ޱHlE+˻0g3vϛ ŃS=Uԏa g#k̾S53"ŇVFx?<:Ibqo9r ba[b=KY=9ڋw';.s`<mwvg. tJ*9ՋfAgP^l\h>#O6Xխ}Lycu}ΧĭE2E˴+%$"TWUI>=332)[ν鮮lusF[egw99ۖF6B,6*HA DOl?\yγyߛ=/xv܃e%qAr,#Nu(0]l3uYcRavvP{+ f_ϓ?pc.r _ߘ~Dmzz|]YImȫ9*'gх,O _"3; -5ݶ/ ʯ! /FGi=}y *lBF3iヷnҥFg?諏|o>vXPS0K=-,>|Ʀ,?ߟ[>Kcv??_}{_:>;='Ol6{ '#?G򋏾ݻA SM6<|lt{o=F:*+ |ibx\ػw*a>Nￍ/6!6E6)˸ĥ%ު*(nF; kXyX;y~&_NkZ[5<8_DLPi(^+nh;4%|RG?J[IG~ÃO7TeUhI Džy_ j 1F/nuHto^EEo$CF|'ݗ3?ijܡrv;BܝJ[ehd==7X-Ruҹ T wH64%yͦ&7+ڷ,dXA*W/?GW=0\AG?=>B\_sz֚ٙa> "*n@X=I8eQ|֋.7/>^)F.Lw  ?͙YXt U1bshQNϮȑ07FP=oWI2@ũ5}uRYc +CUW,D֣VO cbqv)4zy "e74Y;[B)o>X+owD9Y5[33&n-oA_}:#.cB *Ȏ=۽M1 UwCx [ܦ$iio/׋R0cʪa1Okﻖ}p5Mb4Կ>76͏ ?gU߶&yZym .+է}kTduMVѯkxZy.涕; _*pY, O!Ӛ7mz͢ bTh=Q렐F~98ʳһ4$PFq0{EoE^Y+KBE| 0yi`HٳCL72?77Wm?UXk|S+Ywh; dnX"7X3v{X{c!s3@wf#[`ż@֋̬g!+#6y4ֹInsZ@)-?زO&0cN:k0>(H{#t<0uN#vgH#ZR-^?t<=v5L<2PF>sx4[x5IŖWsuw'!c˪Fx>[>;Q2V?oa酅|ށ:\,Hg{s'<Jk\۔y5J0`fj̘Ff]wxp~)!z\2{c./\p3w[wdwz]88>k|< ц]hq :9|&;>pr/-w^Ub!S[>xrvr+(F 1"gjN//mN契kLN;8ܻ+ي?_x sX!7+Nҕqˍ 0ϯ.2}/vc]2D Uܻ;=XZV2/hf]rm6 ƳoʶWGO/N-_ 6g^+׫OVl_$eY-ᄛnZ*{_~ʶzO\)Ym[#p:oSK-25$\Zs HWvk<9fޜꤻW֍a(?%7t/sVYʙ~\+3C\gLoX#v{x/8YNή}w.}wul\4tU#,[͛V%کi+W4:w6r_Vi?Ȳ]_ۯK,>yu?k?v^b5Ϻ4w.Szc ^և]1Վ_wN#f \-d`avL6||YXNj*&CΣjW[Y/?k2=A4w1^jUj~8dNh733Q'?[ce&^ua MhD{=yz!''/C> 5XVǏgfڶ7G]<#0߬rFpTu')E[k kJsbR; tX^n6޶g'O}$E?)79J_XRm|ϧ yPww>&gF\=86t/-r8q0 28ԑ|);`%oLR9jOU5f>]nOqGW5=ݯ/4.w_>/NGu_Yt/~<חGㄋӷ/>ッ_4󯏓Ǘ>.}^Elx.( h᯶ \Nby3b::^y0&?iԿ?&y [4"66 vKh).izxr+\9aXr v2kz,zK>=O 5F혝:ݞg/nA+phvF{<˧B~2~4X\ n?:sntfl[h-^%">p2;)_ˡ4Pu{s}V{xx;*q-Sr-Dwon~]Dal O67[9^b{H)3F|KyFKC㻱?= J., ƪ{H[Ñ|5MTyH,Ϝ6E`ڗWĨ,yx_'l+.,  93eׄ WK+Ы\iZqbR,/v]#PH&^F{jEV~c,ٴ5ы9<s٭[" h 5>; Wiȃwrrx*k?"[Lq<[6?[C.T%rXwjv.,W$kpڑD|ͷ{[m6`.̙!a,` Jl7@WDJ%nSoRΜq66 Bb&vKLiNdY*o{Ƃr0*?Xm+_Ә]YhQvrP==Lm>=9vsߺ-lf,œ_7, +{zgk7kЁ֋y%xE|Rf0ljhX^W^^, ZY`0ڔygܸlɞ ocjou[.^l/Z=}`k޽̀-sոqc&'v?ֽ2ũWYo1ΣZ5)4-մ%hlmWv0];MW\×??+]s{k_&#'ZPm,rO>t[Cu?5͇g-y杞,xb_%֫/ .9fxtm;PܛV59͝1ãW\r1CvU1$WfvN\Z_I< iJhi9wOLRіjs:eoH5S<5bHkm6U­eZ~u]+:kr}iUĆ$WA(O ZUѪ"!qgĸ898 .ܱcFBY-mWd \+c"z6?9>S5Rw]5Hu{Ô^ڎ]&;bww׊ m^?ߒa\eS{ 1&yBxh> :+0pڵZFYE\w~r".S_v~_|y!eRP+ ]Jz$7Y5|V|y3E`:;=Xҟ'g{׵ʫY>S&8T5^SN֐XY;YfSgJܱ[EN" xHHzdb =j 쏛_Z\%2Fctxh&`C8PH\{zIэ:Q/FxBUfϧqw?\K4уۏL&y_J\@[Bث)ͽLшm84՘@n mQTvyo#k^XO(lQX䋳x@bb^>Z`i =C iX3pZ`^ Aq`y.gOV_vuL_3 #p/"fcYK -}Zە/Q_/~K҇kPK̵`^'q~w.3qʰ浊a{uWܒ 5% :[aG7U\\'UQ{Rݖca闰jY^whV[Vlg,k#\"0zcW1qD6\hr{n-+]g:/o)KFZׁ,6 UkUHbyŷ^~넎FTW9o-f>1D7YSMr3M ]/)_v>]]b)_"'.+eٙb669C8/hX+gx+. oIe2~/vۯ(^>9X+S䩽D]D޶9y9K%}njZ14{8Y]w_+&`U@`H,o`Tpm"hoD< $xP-0yw]~8 ޴A(mnQB_ƧQ$;x/>oAf1;7l-zNY6tij吸LXr@.]=4aZV'e(ʻWlnHNg˻+d6rݔeKmv~¸2B{[a޾`4˿m: &f$]_Ӎ'gq'ݛO󻎉%srVO'C2;5{k:喃Jݽ{ުX82pKm m cnu,O#{;{匩Q_ 74n!-K[ώmt=||_?|S=\?{|yq.OCNw.;</YK]\<< K?^e羽PS?^޼tS]w/|r/Ϥn0hT`pݵx-ݘc_ک.=%,RXWp~M2X-m$/?~`aO|m]z"m]ΦsP3xж@1 Y}g_5jȎM}^;2|9J|=`4u.Ỵ[#l.w7}%aVYmnEKXޢP=2t7/ڛnCz윙7NGSZ$jo"w<{ky8wHV7ef\;[DV8|563ncfpaIfqz{4*hGb-gl5_,F]~cXJH>5kcϠZpd'vZ6"e6ZCzNjOA&n+rԄfG#?;8_)fjѮ˂3po6ߴTҗ[._[=;xp݉Ñ{ۼ_8\شsS[eP4ol_i!8_D?rp|h)K]Jt;hm`Xk ie{NwܘF|07D na_gJCN#gnlOVdƦ)-nK~\pձ*QO˗&㯾/H9gy/>>O?w-Po\gG\mZȮRἼxatO^r#~j x2cڢ] H!Z\~D 0'f`o7Zm 2^h;uv~hJچ"@Mm%rܰs>: J?3k$Ǔ{?4/e3]{X<1W*qǗևw` wQ^V_|=ts> 7f$זVx[<TqH2iWUMwc~lWN @[C-Cb6+?~[܍u{b`myݭަq@-ږHueYObV0E5Fs͓lvc WxrH kfyD%i $V|O#KƚScE+u!Pyw>˕!?߼XP{ڙibdk>]˟o.?>:Go?<[. rcΞ_o%q8x6}JABECy0uL;[!y+{%I#'Nsu5_ƣ End_~?򋏾4KGbVkXX]7x,wž!wgQI{]S~;h,}ojf&^XYCjVO#ְ:=q15Hٝ藶h,LĈ:rP_R6Hy݋?[Sl7PjW sőgxk~1wG oHHOU[OҬ(l{,w<Ct Piwҁ3"(8gߎ/wxgY;X|,-쩥dXx`"츋 \DH_u={Or`xIIc9a+mf39FϧV y ot<2x-޻sw<qn?uwͳ<>ҫFVƼcɝiT{gԗ77bt?$]Nۛ35^6׿@Ia'K"'VWiw^pgC-᧏|q"2њ=3aᖟԢN.pxtyoS){)3Xiz/􍧝>;17<>3H>8^[!vVЯbni#~wO57 5tmK.g `DvĈwO-4 ڻ0ŕ䧧ń\O46ӿ3X>m$!`< Zl"n4Bwxmivsh ;i~|H:95]Z|Q4?bgQɸUŷ?nήݰqs 1o==`ǵ5ˇ]{^=>x򴻭zeu2)$I~h> {!|SwN~.q=yy{~rcR}H4 @ {s0e?h񱻳3mΓxvrm'F^Ә|`qtnh ΰɐ^Pŵ8Ű{pq܎1O`O݋rLb kKEl72（J> , {@V?vx1TKrQ`vFxޏݞw6}!&,>[$|'߽qF7x97M+^ۃCp$3Vv;g'@gmQ5BFjxεECݼܱȯ5zeeOmr0aGmcKuh-L,qގq1[9K牳a57_+rԞΎBzg/?Ie5|ETː],zQ^!0'/Q67CxEz#iqY6{ *Ę6*wڷ5oCDE ޽1]"] p{S1y9?=;86gD,4D/aRE総Ds8y1쵣UVg2%b-yG>zQNkp#L s,^ӺYKnnC&+z5oaeÌ''vm Boq ' #b &a"h<0G`L<87&rH!?5g+_~/|L 7>;IR%?'z6ጕ{Ñ}Hh;}vr1 .r_㿎$h^E@CHs<ͮ>y?qgb0rœ35oLJot_htI] (0Bo'^эthRvۊ'}C[2uH\OM_XG*ԣySp/XU &?Mv[~~tnUk^b Ke̶>P宾OŽ{pԝh=v ib""L>U^/B@nwAfnYmA^c-n8{=t.umok)l.[77.I<ѱ~ln<קYv훺t)Ӥ7ZTˤA\nם?f&Y+,;wVŭ*ke+B9?h V,xa`^].4ieLH˱̰]3,ogMR͗Z{EW6䎛7JSX,ݵr@3f~@nV!ܵg}\f^t~@ +B3k9j9Ң;%Gׄ0Ҫ)ݲ@ 6}s;? b>/FfW?IG[fUo;ijOI#&!]9: d3cA6QZO΢ # ϋ.4M}ݗwC_YtwﯟWϘ>TNjqގ_N,|vhaZ__x1o:쾣q>5F ۙ-,Re$3!x~K`KSӉw'0} ?;9?/D[Oh:z6pީn'÷wˬhjgdo] ;j7Tޞߝ_뛐SY<*叟3y/__>={rq~N/) 䩜x_ƋOSj ]PUm Tb,hk=M;ݸ3 8hkz^k s=A(- +YVWsϖo(6<՝ٟ/h ̀A-iR‡׬7=Akfտ=Gz_?+۔C,{k>/ocQ2IRy}?SbfG^\܀Iv{c]G}ŧb;Xkͼ9Ç|M[׸~0wO3,J!g@v%7;{G~_ly,+7dw޽-S+rs}AD{wI?*9[u?=89롯۵;G[2vk&;_Տ =dFAXdN_c-6Hoޘcw4M+9M*-/W@r(o{-R3oʧLE’:ˢ+N{שv,|kgmӚÇ]oyIr&ZٛbGXٛϠuGp,ؔI'G]?)}o gВ1c }}]nH[;60o0 .bwp|ICg'?Ia/OϨ>\F=es<;a 5)M"c5{tEp+ti,6&#wk, SMNnVӳ%ѣӽ{>{=4W& oon3028>ngHa_Sғ#7"/'n!bL.#{ŎΘgKfffwSDo }_ｹU#>IW'Vdǜ~"s21'JaCOKki/ //V}*5vVȝvh&r/&i:o>>_N>7!uUd͵U ݋7?B^uyxޤ@9~_+1NwrQ޽' e?S?Vx;O.?EnnFMĦwkLzywi6;Dmi.}po1eُY䩌OY8pW־y|篈m>mZNMAڵ60jA{;89ۃ(s 9wYPeuv;O1x9Aj&3K#XMܸK߰F%wYym; ]N{x!\bx5ÜgGs85m1C5e5W[f%`Y,92){3srL/NOT)ФAi~Ybg֠(csVY#7wcɬOr`']O~λ,. jq+u"q^;J}s_¶h7ӴF<& qi@6f&OLa-koY$œ?`(X.[f$dy GHCu#+5˧|}rvgr݁f5/ֿ=g/'6g'q2Ww?LGӮ A+ —޻Gdlmxjbcgq6Mgg [li5ѯod0 w 4&?gnXΟ΍k^/jKb'8vGlXduR{cl_Zd%T{I`+Ų}̼̓qaoqV0/FLS1lN|ps9`!P ! CG&%ƖT`$3t~i}2v͹ eo>G݄pa< Qrmݭ}uJ]U2LZ'O77;, PE|;̝&/<~#WNܝ\˛k|Ǻ˯3ں]o78^Wg+L7~۝8^t5}0ƕN3 xmPgwMzuMS.z{s{棭Wh{Mw=W_I8ڎϩ4d[ |fx&Vvi3S scQ;!@X!_WPakXx{ t>*޳@) W.\T/>**~dkXċ>;o?~ z{g{7aŋhl>*)~)Yܑ ]>;p9kک?))k4\^5(a?4 F[ͽWfn,а|X7S]$^nUh1f _3I/Exx;Qh?[{BL^Vgn]h7K/CtN ^>9l[ q6N $.ϼV}:'ۜp{/q׹Tg×Ӿ7(>g].OOdzՄUWuu~[ˉ:x+'8?pC7U;nV7t,7 cվsEizV??OOgHbyI?]UU5)֐g`EK_bXs/,I YS&]ݴ>ڷMp}ESJ|ڤu$w4Y/BZ+iD23WI|i/lW鬭,$E^yLhķE\h|S:BuVuR]Qe+Xtu3kKk44YOEm]$/>*ʪyI>wmև,"sYfʦ:ӻd|(ufEBmӦU],^/S|)OԍӬfmMU>][ ;ia˴7yiҮ(˨y|.&tIn}j];_ͺUSk6*I5oJ۶1I\$m+J(%m*5&QI+k7k6N;-zh—.\%ZusiIZUOձXծn,V2/:MfZw^!IR5[AvytuwIkI}&kE5>jӐ.wm-+XvmYikje3 u}5PZy[}Eԫ45Eֱ-:"E F-,^AlD -Ӻ(Y'vң[R,iMՒߝ\|H6vBi]5Ei9_&"IjQ [s;:aW4:WjGD1d>֓&,jjJMM|.e]4KZu!杶|?JhIIHznJ\PLH -$U!}JQЉQn^NwUuP^XKZRR{5[Rfm{ҽVXn~ePD_m}MI6&hSN*{1i1,xzqWSmyF-6m+LkڪV(Rd}8L4$deseUdD4!ųѴ/dҨڃڨe&[TVmyaKffjWY42TD2k7F zvV*Fc`{Y4zM)2!%=j4t}Jx5󶤼q&eb%yz-)bJ@(ACK6ۏy.^h䚯2:V Fjڕ~iJ,-c֖askdX䲈2ߖQ+֕i+%X<@cpQ"ݰ; %ʠQ*pQ}1R֚&&2HUJLh*uLDh&&SlZ1T;)!~>Mdx˹W85$WG#>vR&$*>qʖf(ݿ5Tj˚qV$'() JbN´J&y[^*p(Hz# .B yB*XI)kޖ@)nMWWoɥd^M+>&R[ hJcPv|o˞y'cVO q LNj'[ 8B_3e)KhK$m-N1J+3.iڒ1vV_u-[HXV64϶s\NVa~ @t!U R>FEVT4}tL;(!?SX";,rm<.;CٻD\!I&OV^jUFc1C)BTtR*y%55؛lrLrM_ee$mGJA"01nѫM3ORnCѸD_j+ƽ )y&iIcL~lr3GYB⛩4"6xQgOXud=k-4o&Uc}Ad ieBҲdEDz)X3Yv&dqIFwD/@c݈*JZn0 Ǭxv~F)!>8%;/{IcFchwiUlqJk?ImH }mCLH~&;u_-ʲm+iYmK\QD०L#cL#/)'k9fNFJ4G)#n}Ȏ-28+)P6z~ͧPH1IW?i՚Z;Ia6SZU4-Y>M/ɨ:\b^Բgs!izld)X}2Ӡ/uII]* MY/vB(^Xh%g+cC/O֢L=)}qNhͷM#sF8n4t>^ IN$eIغN? 2Ĕ8},fgmf,MSc)h>H38* DG[-/MQ#-[W]F1R^^BC*MZe%+{/j&>U=oI*E#Pt,cаtx%4R*RRenY[^R*IzYb}Җ %2 c) RzKuڋ#km^b']^$Y&C ؎L6Pd=HdU&Xڻb,J5p5HԇJ -]ku~ңfrHrAb8%k4Z Vr2 FlhfW[<˻7b12%ƶK'eGe"ueMFܯJӑ+:124@6 UzT+CTU:-Jlm鋬iB̴r ]{BAF#OˎS~1ۥT\$j+1w3_y)9&Ē(U_If&;JT$t:g'\ܴKRh Z=U26[W7guENr*5<-[9Vdmi N;,3PFs(^6r=U/=#'m4;#ԢW#uHZq%ײmHtO$Y[~3fGfiiG S_8pmGk {c y|52u#/ ːоn~[>ys@eK^#M%hyǏa18&ڒX%j HZ(8${;2$$$ &Q*Wk%mIFgiYMVD.,-$FS3:ibL:N$sH&dNFTENdxRPBqHkxf$dnv_QhwFg{p)IF m< d4tRA7Z$c5t:|NjiWJikVb#,_-ٮ uC#0Md刻>%2MUh/8DR4yd-zRIQzG_plHJeRWJRm'YLҒ̓+[;ݦA"5ZZT.EY$3vX& G%ġ44}ԨBmȴ +t/tg>R%kJ 2;gdW Auڵ̈́TF?oӊkYtT|Ejhۦl5}f2Mx"5^fJ+<)릨/bZvA /W1__~lMK4?GMO/ںՠRV% ?r&@Ry-5Siejj7I1E6ˌJ Ը͐ MR) 0A!bZdGbW0gm5I'Q&"+MGdpx΅F3nw244^|LN$b_~ լ~+5K^֥Җ-=I'v40u$v7G-tseh])8]du!UWqb]E* RkY[ReiYI ќ .$f-.k%(r.9`v-BJL+Ԑ8vZ:)A ;QI\ʛtEɏ().ULWd,k 6}rds8쫥j9dLۈ!K7m$fm{M^{Lj]$0/egevT:) h9#]QQѺdvICē[$K`F/bV &|+#^R i ZhNjI5-2ͱZ5%y-Z,pK (jRMi?>/)YN ϪDEW'}#%62WDĸ>qHxqnĢRizE^JZRe}lLP"NL V]#k,O{ĂT$>2v55y8ΊdfiA!* ua{g%)x˒2"!T]n#ˮ4#e-m%&8W^ȄCjkJUQK!O}V^J؊zu6ZWl}bC-jQ24>@M2ԪC(08y3o"#9&EZ)'-yJK P& v0Ee'-kiHZr|#DxB2MeiҊ5QeKu!U,TB9 XYm5ZQZTSKi6$J;2\"k9 &*8%qZc=J_J탸&P!/^&)8b$|^μ_~ʾocLh\ASh{׸b!,tƆLwɤ*s 2&1y޲bvnW:c.`z>EH' 奜i hj$VE:oKrԤ RdžX؄RֵXEEC"IAe~#/ )ڛueyϒβK%::JlDkO# I f:SsIHJެ"T d٥YD˫R.#>Ml۹l+ҧdp<*ͷ,➀cIDrKKeUM*R#"T$O%qD{O[:i)2V$y|KI+~׍+0r;= #XdT3=n~!KssR22KR4KCNq! b%o}*&%A!I)d 137}ZXVj xesMWp8Hid<5*/jqSi!#51R[1RH6%}NFxg$ĤHK"[1%Q RF/fTHw* ^R8%伭NjH|!OI=Qi˔jeagŬyNF(4>mhv%)!dG Ą8 nTF&\ڦ$v/J1tKfs:x}&{!tVdhaT%6uFW$SA%@Ie!%qnI")K"jqx%FRzZHdobNY[u6DbKjP}M So޻Nȋ] ]}1Wrk$5ׅd ,R}BNe3ؽ4bY[.v,qHTҮk)Le)ӢhUv0{)R#2G{mͬm"ՁcA(cDKȌ=_䤎׸\nJ׸|$O\EPrR-Kse%)ux [FB(˶'k(y5_m$PN,4lA):Hz/+-,,\."%VC\.iT4/;23bba i-G!&X 61XC[@MS\&͑SWɠզ9Dڑ(%m 鈨@I1/b* TJRd9K+ 0ҳN/vxY&nJǵĉdZ ;Lj֢6)'}##[גHRk;1m?GA(vkXVJ ɵ) 1QKxOK\ִ;0{VȫY]N;Zַ}zD_1$lvy[`AZGRDj "ӱo@BUV%Ș$\\5ɡ(A-yJP&(~@>Dʊ" EP1khH<Y[:ɣxjkԀ G9%SeJ-)99 ]S,G*& A2-P:cj5ؙ."2\ah> amՔHh2\aVJ";0iذe-ZFI)֑EYld~+k1ZRz|_IR;Bmi6%xoK#dDoRL/A(>QHdfq44 դzF1NN: d&ċZOuٷ1ie#"*ͼ (0E w9ъ2$"5m^y5@V#i1DZҐ~Iqfy[uAdۍp$p,p.4‚eNTdKrZ[@,((IOgQ4O͹4LvARLl.Nk4S}u蔌ǖDiRϤUkmeY^IL^U &hR`e <@lBijXZpdJ Og AW/#kSkRIR+=H2p>PuF^'Lb)˩UJ房cIiֽku,Q)K! +$IrSqH!&Q<~5TErAla98״u1.:nm!p"5#).uN‚DjHlYF[)lߵs^(9DҢT\~IR'aU-S]Tc .Z!R<D nx!:2ny"+[ (A*?FDD"2#gSJkbIDsPxҕEs[E4 _T.jYJMҤīg)T㜸})賽R19U%2]eĿ2 <$I5zߧY5BmA}(8w1ŜdNrY]R 76S;NJ)[$R{7F} #=-E/Ĕ]oX#Y=KӞR0ڥ3KWTO8(Z>ߔ\W;PoT-J䌖$d1'gފJtgY"v&$B{ H4H# DeCq:+s3%WZIPUhtuJ #}G566)Vp\{i⩢M&) * Fr xo6l,\`ui_Eʻf#U- N8к_I"{O RsITӓ$.vsH&D%9@pΖ5B%_>ަΆ=! wOΑPloD#ɪxD}P `h=bj3Eց8zAb4mY(uNyOрGt6$G$th_ $eBTL;T0)3ig3-9e$9ZNPL2^E:P3NEąF@{R /V{4( 2j9ep/ <)ϕJMB(9(/\\KS 4}QWmbnp:<#Ѿ&Wdr]EC{ 5drEh0 |1h״0~z"ي&.h}{hk_5Eo8K|7U➃51ح#eie˜ WCi7VOőIcЀ,}5|P_E#UH,ң;I{2IpmPu (RЖ ~JN9D`@5^רoo$FL?V~i-=IމFeAk|ĵ eweho͋V-Xs`;ڨ0-dL+ubcm.|ƙQMQj5}A-В}B!W_\4Ie'}Bڀ]A]J{|#*ۗoG!).F\#^Qb8 ʤn *։W@]- *%MNT=):ZBP#>K!ȹ`*XB9LpKC XZA?A!N%t,(: M d9"!4 I @hfO*ŬҒd*JxEh.h)M'9DNvvJ1~Ca-hDQJFoD`?iדZomr 8D>4襢N+*bOVjd'ƄuY(5s =Y2NRX/Ru;NZE{AƣE~ifPD=igʼ!u f uRƾ!вjH69սne PC!Q9IO܎phhW1ItaKR57-:jgTe7J65 ;R_dVR[j|pi :z(Gz~%u%NOύv (OUpֹTjш9DUͼ uP=0i-(V)a_KbKz^ڮ$i@D=)UP˒G@7AL9(в &F9-p&1ms}v l iֿ>@B]_~)dg5Z Ik_بh.H#*T>f @[Lm色(-IIN7|MP|nR`4ӶNHڥn9F8Io@OR nƻ1z@%{\KbUnUB ˮ&5~+{dCHb;>N{^i !?6 `ظ:?`f4Hu=^J5sI0(e ,5V"94~yh)c#=O>IG!$G ݎ#S%*:B+s $d w% f^UFNeO,õ7Z{,4=ڣBkF+}73(G9PX!0\ 􆐓L# A SÐGS -G%h:HpoPbԠ@Sg\ԟH^v%F< ˢ\FSNXw2%@lP>lhe=*]Q"gs|KmX<ͤ1F RڥK"beljFed1z26gysz0^G%( ~7h˺9vzN;I{y^8h7#(r>zbR<.>i$FpZ|NDE1EAW3H CAF|32m P5{Bt#Z*fW5|0|MA0T I#GuC~EgZ=8? ;m5DGeҎS8Q)ƎY8S:HKY<]h*P|脲-,4I(D=%v*qZIдɣmq;B{r>Z CMփ. ߢ57>icD@bj@.mQa@ԛZT}'`āPH,x`_[")VYC l9ԃhݵƧ$n HAQQ}cXbKWBz/SCήx";%dd̏!NvPnX`MHs#6Q1$#S3 DL.XL ɺK%T9ıug4GWE{.%x t-̟:Di-#R4ˀ-s/ugGzqh*&ɢARJ^$OB1ц*n Ww铽@{AD;Og|CP NA󄺀|n)"!Q<ȈP{-;B90J 0W0>ж'<vT#t\ *;KR vfD'Y % ѱr;{Hx?I:}_OrQL/h`E{ x]ùfNuha9v(HT]hyHXSZaN a@wZgmNtU6YC&Q- SWu\-**'N6r.AYa(EQHte!+ "}P4 vbj(.Eeq@%5>ԐvË[uT+I|x^e{$GH4Ck7HI(Z`0urgмcHMr KиX|Fgrfu=E%w-^f_ZK^fjJ&|_yJ<3'\P U.X y/9PpiG)`FuP;煖H *@G56=4=W "8+VCHJ4ط""4%DX^#~+:n50eWOe58^?M^i֤RK"J)}C!#cayGY*DFhV~y:D9mtw};iѡ? a`e_1UFECfOσlbMQ?<riq< "U:~}]|>jZoYUkRBT-2Tͭ&䒙!>)1i;Unϩ%iOjK@ A۴(,kk#iS iUo %Иr~*~TP(-KC.vs -'#R9uYEI5Xx!WM} QhďXUKp*lT]i<Ž*޿N R%9lS* HecXE1Ji=C6O"Kв|g7Ύm @OJ3~ fBSyXXy@!JՂshm- 'В%-DWz h1> ͢y+-^FǨtG[n.Z_()7s~SmIdP#Zx!O◄`Z4Pϒ)dV6IYFQ9mRDktQ:I1-c PL % ZE\ &ό~4RzCDCk9酴ᶄ-%־w}xpb$}J% jK3맥 %SZF|%NV$2ujRb XbbFLB{+!#~ Q2.PWX4haPE7)@q"4@֍J"rB|&)5.5/hW1z{ +E#,YaˑNBNfDIkjiZ3 BCi94bƥQ؂l*NRZ8N۞jBț#RĈ%C_.J(%1  Id!r0m)CCi$ W(M:*;|F}uW˾PN([wUż2w<>'H,Q"D7g(Pm㚆>#^þij~df&pQ2a|ED=Wwm\)X:;ŀ@As`뇣%yѮn$ŘzHS @=Eoee(2tUD?,: 0$8z.4ʕS=<VAuQKo13\^`:g[vS|Rssȇ H;cفPRjBYn(*_\&Dh,| 6~=|2YD.J2&MQfBNP׽ 7T[]Ji(F{9a$Kim^&+&2Ʉ(~ڝрwb{pICɔlKwTGtyh8D$$oRLHSN!֝^&kOm|%I 뻧 iTlv5ϨCzvf|!9Sm9آ}Ⱄ{$)An4(W/S8B ,M[')GؖEXb~A,`b${REʂh-SR 9;IwrHf?H֔ltmB zdehH&TFۻ F]j{*~Ψv|=j< ec(g-) 0 $$3Ea =|UF]!oq} (u SoكE.~KY *>s-s-SSq(3H\*H,vͫ~_VC Qqr h[!esUr +ˠڞ֎I3X(x~hWڸv1Ў G07EB%Z.֛A;J2 K=.k ;I' |F:Ր]PqD +TtnNhY8/.'@eBD@VA~Q֧%0rGNJ:gy4GVόFU 62ХwW(-DM޷CWIRU)a1I~WB ˔iBfi)FRg<~Ʌ"=F(JZq8ug^;>8p>Ɣq"pD2QH(lrвon8nk3ҪcCPA, *fxa4}X%8b#y! 6Umhg;jk}݈h6'}fI@" hS}c-B٘BGϒ8?Zа+iU2jKAoQjLH6 ΍xD}ٓXm@+:iMNvhEq5zOmBO-S1H"8 N=65џ Xԍ]i`{,oƬվ!D$ebxKN-uZ^c80u:%V`4 9q>WY]O+5'RQJsJ i?sx-zŏD'9w+L Ť֞]!u9՜IcЏk*vX#OY~YjA zsq4P$0&ꆋe^;M+ ̩*$͝ S-KsFeA!)JZ(AhdkT5ۢ܇fuug1Gܢ}75uN5I@Muo;:5=k'E{!s!5> lzqn)6E*A}Ѩ9Y4P*`Ys \KmK+5񀢞N>TM(ŻJsQj‒=zP/$A۔uJqJڧvG5)8Ӯ;%>Ga'RS6{ơC9)yD!;8c]zC_Pm#J@gR+%93lDkmD奋pьVњ#Zz&vQMټA)#NAA.EߪG^Y~}ny|B"O>)}Ih@h!3X&!;B'us"&yL$+"ApԘɡhOHA?8qzDn($,Kb D{T|5Njyzt aVV8qg$pZz&S@r *0:-FhcB6>`xTo0 jL؀Eqs3/09}0S^.$J!W{ ZW ;7 9Ķ5[^6vjUEmġY#T5;港A)rV#%T.-@'+/WjxAHCsFJ]YkwV1$MĤTqFLhaCTvG̓&w:{-ci@7e_Xmh["D졆@BM % VT6bJmCW#C(yʌY%|t+ r_=NL8Go-=uĩ4V'%0O,QC.6GOvi 4b(jNؿul'D}"|d}@Z]OmK&,PPRЛ[ҋDܳv噇F|*h/QEt^z2-UjP>l ɤK|$LDy4ӴvXa@7lO E5[j2{^]DsBpZ,*3>Dm& >2N2θIv@oo8YIOC5iɮ|_Qnވj8hI~KC>8tN;:xNl]hPfz'۹Au)AEFjA=x qۃKz)2#i~jEh/P4m3yYK Ћ7ڳE{6~LLp97l]"Zv&j TN"BSmI, QaQ@|/ Dq!+U ;]Y'=Qxqˢ5񺢽="`z ІvJ-Uک$:zoZ7D(e|9d;nz{>O=WHK/SbFεd4R!QAA< %j^˰{cbC5$< sRI(Pg\䙶dИ/,`J(iuzK q)'>M+]@K֟hW\JRD . ZgZ!oi)K-`,LhNe\[(l+jʞ8VBʷ&pJDG])(hEIpY4ԣ^ "i -mC[MRHMRG'/rŖ4$F8Ђ._>%Z;Ѐ[.1  O3ypLYp೴kHB!x{bQ$l8- 3*:q[ ,ߧ)z; ZpKYWf :Z 2cja\u֞&mUӞTY iR 54/ul' Ouz/rhg|NTuc"⤖)1'nF֥qQ`@lco*EyPE V'BjgC<E+ms 'IiA!]0x j)K9"._ڇivQDx7)JLx::y*31xc}hI8|0L4#r#Vo@Vfqro)&^A#~0 ƍ]ֿ;qoﵭAqաkA2d qO%CGvx}3%I}3Kú%ȟ}9$4RZ?*dj(HGJ 熢-8^@@QxiO r}r'T-Z3^}NeQOLr푡uiXyV*-5V2ھ#-F$HM9_3@1wG%  )hoUF/)x\?׈RA9"Ҕm'X^|^)j7Y"9.9E.h K<">V"ejE%rQe)xc.=x1t%Gǟ5$w牠pND{j78Ju?o hd[6WѮ Z3!~[mWcv6*G4_mq`*2:k~ KCrXZ]iBRE$$j[IoYPkF; eW}fSX lY( ]ZEM:҉%*A Kcv2ųDh~w:[v>MT5y ̀,{ID_is58`]m90lsuRZ31cȬPB^Mty%i%ԗcБ!&/M-k+׊mw$U! n6OCQ<&|ؙTc_J 7J[d ,Y~GsۖlT=Ѧ tN+ZA^<[4wJ IHJhPtj>r-V hHw:hcOwMw _BA̤P;^j/|C X~_[ A#wV}餙Wُ7L:rBOҎqgڐO!JhaD \JJI^~DQ1Ewh@<2Jjz*mowC@ҟ9_f!E؁Q 0R뫅vKhce<MCq!tNv`F[\Cm`A(t3`__{= >܃ oaYQ ^f9|'25'M'Þ$8 &VQR*s)sGVN܎}Ϝq“(օp 2e\L o 1bOL&|xU@P oxqL-RUE(5(;^J u =ȥy IV=3iҬH0$?ɻX!D JS&3& 3/(ZXvimddT@6K0+k\Pe{h>8-ZIxP@NcIhN:i0mCrʈR=rE ¬(q'|v&l] Ph]{@4En^V =qH~GyI} &IHOɏe4 @U/*LrbsӻI!PK}%['A"hj>̤b'GBRl4%묒B\(PEL2i ɝvSHwh?J{OZ`gxSK̶ժN͓ {O)8TĴ |<^W߫EۉVyߏl7FNm"O(3E>o$y\(?E|>E-< i*yAu?$s#׎#!HD+=Y}&HATaEKw!h$nK~m'T#58@l1JvPBgH15~?~tjM C"OFQӜ-m)[9KM%&]#δ4)x<3ށ)u$xTRJ1JE}/E &joy4PuzF=J[Ś*mCk(7 M=zhHsJmɀQl ymGo8?gƘ(Vў$+.qBʜ)W=e(i`B;Lh #pړ{?@PGrJH0y JaC"_H_hNό)@Q i,#2 YB}N AXu^ 6@AqHJֺ\ݺu|/MO,PB2B{n㡄>0exYM峝2V0.Qh2ޗbsd Q:T9QuNߐN8,)@" S)d}" be+EAV/9  y` ~Gk*Sthh%E4#OnNJ4{B6B 02J>8E˴Z泡mO8R{dyKdh$Xpd.-ildRE;J+%()FoќGdmu aJ$J02HE5s'є`[Y#yʪwD;h{߂Coy(-qgq hO=؛GNV)y|AzK.02= Y-9|/}@ )ڔojU;(6BǾzZ0XJ%:^EN_r 3qH]2@j f9< HL,+c 1&)kN7zܓ){ P}}}Y ˜ЧT_d{YPN huI m<{kZ?ⰊTDZTB V/' !Ek$eBhvNA8όXZEt=ZҴ.ğE#ײƺuzŢ[B ֱ9+Ī)!*35Zru+H­֛aW!2Fak%y dÉ`'(iL {eF* \sf;Z$+%gR+]Vp]Gi9gZDzMqR]/>yLx<2d||?8\+56˧bwkWe8k#-vH O B06wKFrk8hˑSi $`  fWU]t`ꐠ"I.qvϩ \P5h%-KkZR9kOo-xX3?T<' KֿqRTa(xѩ Ǔ_|_pT?! 6R37 &Ƅ/N8"q89YB@/BӬ#@^zpnv*[2g3-H)~m VS %FC9Վc:)%2.bd X'3(;9^Y[? >LkF7Z;)[WE}MUB`h)%Uj7RFeRIׁ *y/)zkҧ]𲢕;} vV\Eܜ(1#tԁQ7 Oj عQ 55"|WUX,5'JH*MEh> ge@k|Ţs,bLa@9P:ӱc}D2Oˉ~<6T@;VOI("^Vӌ(Q3f?^`kt)KGk~N@F=='`0%NK4iӾ'6Kxs GhL^v!nVԦn(&IRO'C ՚hC}h}a䰩2?۞*o^Q5Te&@q쳮?sF4 =/0UL6{Me{Q[cd7X5>Ҏm>~&c)?ҫi·z rh`~aQP1?**~y+O *}YQxPDeArԈV#yˎaɖJqhqg 3h@*)]O[ٸܣuO\ZnKhGȾo n>GS$C__tNq_r>>#=1lM,2{#(=[8}]k RDuapLvth/Sg[Q}KpE@XIQTE/u}:APNM,/e EAid9*h b8Pv] KsΡzbxzN Ѱ>*I.!:}{{JpJ`ˊZ=^ZvNdكDeu\)paVr&VCe!G%' O]FQ_F.@ bF ?0yxW]9˺䳴 ^(IwWdstCeܚJi!'vu5dJ𙴸pzㄓhE.'*⁣9`RD*gC'T":74SbTe,.PJ- 3/ptT.'PZ>V6uDds_8 zNljgд-Tͪ) uiZwKX0:J>coAaAD[ Ж.1+cE=SyȘ@B V!p['$k+ث;+K?QNM @.O'kc5V&HIdv9˜c=#BZT-s];eQboNb)pG2 %; .r B:RLA>ribփ H,d-\n:T`PsStBV)Rj``)$}i[$X2CM nx+A@ ŏIA3. r)q 3L)`ӷD[ ck mā$*c΍DlWīg 2M 9GqXHV!@nfWbl|XCk޻.@! 6/Z𹁙̗^Ihc.5ڱku;i5C1R$u뺁Q JHHj HTM jTP-͉DbY%5Bbe\H0 qRl"!PXjG&|NPA5g$ej z@xX2^-`"о'*g'yj}k;-'rSu*[\ ik>- %-rmTcZ+5R Cj}guθN7#:[ZkodHO?i-^1]W6i$\ 4Qj\jMN'ac'="aC.7%+5M8e oT9Tz`jovid"ါNTDxRL@K Yꡲ8)"WvPDkQoz9|#mž V'/:pA9 -$ J8 9ʃ8TjtHFA=2GE(a" %rӵ^6=gD #Oֽeَ@ 60!tle}]Q>AH EyrǨw2@0mp^jWsEi 8~T}Hz~y|8x08JqM2u%]2doh\989)Be޽F78{|x3 ΛO;?@ki![F>W[0:7Ucjs/MH8et[ļ 50v"%}HA 鷉Bx[=JQyg=&rh7d{\#_a^pGqr!bXsh?vtmǕB3ibGWI˼[ƫny1פO㬹@^ƃߡ.6 {y2ГiOG{?/6^63I0:KgthwD\BNϠٞya:)O&jӛ<ɘ|pM,!=}d~䚴IEX,s'/v썟kYۼ7eΛNwYe.j 9?ri%mYu\c6s|on%^_Kcۊj WjsoYS?1kq?H&xdcx3KsIƓ8dp# |68c{lsz5f20wċ1^qI~ v Zk87fލvf KOXk~$=ȭc8(Q(H!:yLZ~joE{ez-u9oG4/w;+F w]+85hʩE{Wa_{(|8S' N(;nB?ݓfV rzXH}`r|Ik2s_28~}OWvqj45?pg%ei]MpԋB+U愛;+EN"1i\J8STu=ܾq]kV_<^nc|*OwA|*l@yHi_oJ2gZ)f^~ŌD\ !Z} &GR Xr1#SlJ Cd{wJv0tb74S+!~[ƪ敐~Eqr:%;]km[V4`I\G]Xpg+lpݻ۔*s>/gL`Xם0%xMV7VGPLܞBa'2Ŀw"-X K(ZDyۖ4_yĥ_Df7 2QM]hXV@>+ң]O{mX+7?eQS6mı5fe&Gv{6p+6x3{'<`gsk^x}n19~|K'f߃1١ ?%(&WrR+y{=br*I'okqlO7F;~F rfxw+5 ;//WOs{^mto3gM??nVi=5W*:,ŲB6r6׽^,qD+8^hYod~|3| .ƈ+lwzt:41]owYnf7'b Ygܿ"۷H\auyǁ۞/ia9ԫX5pioYϳf̙Jq/ }}csbk1qy~D^'^F?Ѱu9B}p>-/7D9bLhM3w~u 7I|%ϭ0wNB1{z=b/Ϫn`<Ɵa(Xd֔~]AMplP.?V<ڋupf>!F:$ϳ쥴=2 ld,?Sj?qӼ6ji5*N V?F;gR>y-m֢ΏƯX7\ffReTgdGƹY!L8C(gev&wnkǮfpB?k)> WH%jH4:(&珳:)c#)lJ kB͌U{я6@/vṙ'? 6m/{pX UZCҦ?@tcQo^ŅMA0(VZndGgGr{}Ѻ1ߓ^?$oGt~N}wG_}w=ΛRvq]*8q59jJ]id:D@>ؤ~8|폿JN86cfvb3~3<3!IDŽ?7t$)Ųg~^P:#$keZ{O!yJݮ3I,`{M΃0e3=x}kVݔrl֛=Vgť{̶\Ӭ1h~aOw^~/xz d54N_%1n+)Ycߣl&-8?X|A,|8LƅJu^$,ʷ7Vtpp5O9a?f7fy;YC<+T (? ZBupTHtʤ |O)$n3/m|$Ľ1iT!\%McV4xQy8%]mb{8N#p2N~`1сԭɾ^0~F(?cX*i>jvs4}!Oqn؏wϸ+O x~k:. YOV`?>37yJ63(BY{)J-6Rݼ>GNgLgf<6UWUy~o>r@tsS[79_],35Uy7̓EX)X^ {c}"9o$$HRȞh"b^}6UEڞDLkVZ1.V.c_x?X7VU4{v f#n{]FýTRn=j&5MxK;`Me$Wv0ܖBTg.2! %^(cӮvqGA?{KEŸ1ĤLǏq=`\~o]dEBD*3w-K-"6 [r&D++T!|`Tbτ _vy-.fc斒#: [ uwkOx:VԾq*lyi^g4 |;h;Q}=uxb-x//!OyH1vui{oyD_? WLaGJwX9̮y呞`0j[ b] ^R%JpZrO. `8oЂ֯ :onrI q U"ۨyL,KDž<'VFM>J^$lf$I*#Qw~ULX|_.ü;7r1W^ɬݾKKOԝ--@ڛUϤo_fM/,}NX +rDߞW֏O{i,x`+.l88y(MUYl#~|HtʹPOxJ[ڞ& :eXU_7^hoB ~doƉjM  T핏p|+MM^5/,?v(LRƝ)4_jT˾:(8Z?K 35FO=z&ܸpԺA0#[KW?f"h˓X0Tf=g.8]~iЎε"8%vM Eƾct!j 449,3J"7H7&H!>zjĹc2.~TeUig//#ݹV3[7X7+v:[xvl'Uq<%:_:g3paM{M/دWtn+:jCQMIގ!Ёm~E;ݒz뺎B𑵷' jϽr|aLyi[8  Z>4Ǽ#Knԃ:8Bøwq:NnW:ɍ{p~H_pHq|?vMHkt:S\vܦ\%(:>ϧyNv<:߽IM7=¯4zy{FùTBYHFid ~ESVz|3n.'8E}qQP~aSQ[N+mQi. fjy `g3y |--: +\'׋X XV~jE?;6n1cYuaϜMEA\ݫ} SRcǎ?g\?Ô:ܤ8bv</y7Ϟ?h#v|bQ\Cy2ԳF:_؄S7{|Eyګ}W;u[B \j]DSEDDƫN+I+m]9pN$%vr/S#[ˇ9P:k֬YఠV/.7D,y'\7}OW4Ytt899t̳M0w~9&SJ.T%Z},nUt*kfUqUtj\[Dj9~5iy#͌n&3ZIhAy?NZ*L`P̅D euSQ8L\qԵs]O9i+4 wRKE(S].Fi$r4.u58z:o֖ղy ` ddv`;:9TWFz$Z1IOL|*+qaD>!`[7cZ׽ֹ H$- m}Vȍ&coYKUUpW >739(؎' bz t|/jG9|/puk ھey#5?j}d;{_Ro!}z¾?u^N<~>inʼku2tCW$Pf]D{_"À24ecA;4pU\oxVy^۵DK/fjJ*E^r.ya}Ha>Q;p6yo3`<|3Q`zeg y9gV!ǡJ?[.H(8%3PAzzXM;0/|E\VKd~%+\#w]؆3=F½Jb ,hx&,#މfb:ly}?6uK!}cZ/oEJKi/^p\kWjVc`Q3l'~Rz-#̍ş:xŏ6sY-'˪P!z2Տy&,n{__[v{ 9`r}3*TC/WZ#S<̃ (&NCM8#ɋ赳 /1|-eYshw:߈Y+'{=q/ Rc\7Ո_!+jeZk_9A1}?$v]1Vgկ(Ɍ] QwnLtk ,J(+)J%<ӖBA+DeMw߶Wer|"w.R*] b1?{U5sg/ UKb`}Yu3~XYt ~b37ֶDM#o̔}Fd| xl״GϿn][7پpjWfv|[a7s[*8.'~_koPhe =٠J |x# ·w^+ǁ(^.XIvX[ed؂6|}uT.˲NmϨ-a2Rs~y9gܜ[5:wy/Rqb㔤@rgMn^Z$(L\v[H*rTj<3k8u[5  険Qkf{:7_x3 {GaGoM7`[n;ك4*ߎ3\ئ+3V ")-5|OT:FCQA$$Үy-ZKf驈cig&\M (}yeq*߳h%6ݲ?G?O_vΓQb/>N 7D߳ͳRų_Ɖ;~ttc⃪a_ku?1K*X+yޘg,&2D݆.v+: q?՜='bx_7D?~KZx){cy$Cp/s@9}Lp"߫Ha8$?T+;Xa7i.:=:.ޒz}n./F_m/4o_1q9ߴs-f''\v HG|c?q}f%X|b୞%>vMKy`GV́hUe\8KLsi[S? D6wtp+V,$kqw' >tG)06+ #(ST?܊OslJbưޥ^~"M jW,~^Tt3R=T?  ~.4 0ںwZ[.KJ?=A{_>,*TJiyK Ki`: >p^N؏Tņ?eUWS ֹ*W&I=2 :ťTvۇlKq dfޤ_ї1p%_#؞|Զn(jP𸙇5굲񐻟~OtQ#t7(am𯾣UbDUQ8F;0j"RhzŗZ`f4c~Ɋv_GXD[}::;FAhy*M CYb\Pfۄ3;l;-T;>yOgqE.PEzLخhL1ۗ7b9uUzQ,UѮ|`Fڅyc .5i)? NxYu8m:bBGxTRӷ/pwWkqE@;~ߛ?N~X*,%`n54ƍ\K;FF2!AIf-u𳴇s{=k{er [q{k<089x16, ƭ.&{ϫhu^7 x?S_TEUv]_9^ eg 6+?qٝ}-ɖH~}vjQ\gif[*f uYu<*CIPG5J{Jf7c)8:3 IsY86?WNA+`~(M]rCOy"-S4qh)m%5 FqpCn1:|i$'Q [ r^(ec?;b(Sψ~CyA7?-CL7HiZw.Rxe oy#ekdM!'4Ӟcӎs$%$eドmF #pq)#?ROVizFzc%8hr&d6?p[Li6ՏatS}?fa(GH>gC<D^zw֋A7eLvZz8^ԕQ[2>;O߈'}=Xg^7sq?oHu=1S$Zt/ і }u0x̷AuPlz㾳noM _BSkdJD鏪F.I;˥+*JX>uܵ 7K+q=|"Xx<'}u9Zg[})bT o/< *͞u^㞢 ޖyok0x<?z}eϻ=x"#`8v='HB\28:MgPu`)iTL4ׁvɾ`pŨ?U`?y0Ʉ*mCctQ s>j-=JOZg?H8mJPRKm]ow)=B.iEB9'{+sߗNq֔eE11 Z)gE+ L,7Lmۧ UXsV1y[6V3Hr}o _yg*/ˆSl_vE+;A]cSkR/"l,R+0$Z":80c$a؎UW:nNĦ&͐#νؓ_*|/!?E~GTO^/n UUΣMlá v)/9VH,ߖy"]vYp=#,y: Ku~Y^|&U%*I*Qy m~_M. (C>X{bBD`ςC_$ByA Oj'jʊ mpQ8b8 /3߶͌:Oi\}ϼg> J`SS{/^4('|`=x4n7G%|(|?%2Q>E+."ұxe-Sv. D gX QaD`"g`_cWsh{☸هzW.q!S#>88]_W1F vqs-J8X|I?^ϣ"#tyK6le=jE3yՊS\Ƞb:a )3aUA;D|9ѷȕ]c>(ث(&_\LFIIbξb~"_ S2pm%uTa3' k34Dn~'T9ۧO$98mwy5x/Ğb=?l ^8u‘ط`  {$,32VjVO-ٱBT}sĆ<.~̉OخU[P|Yꤿ-{x񳬗xKϹB< ¸OrRu9~>8y2WiAz}R'*=ת.HQcex7o!jmiA&p^_`X'o>3Zґusj**7ն֔_G ("#8n~G9? ڈ,+DMդCō?Yl'_& {)k.mKEdsrX-}9}$\LJT ao7|z;fw ƌ1>>U癹Y(_>x<񇃕-JUiAo+ Ailӫs73 {ʏ:޾}GA):a7_Z3!⿸aALcav&X=a|C[d?u$'n^v74$i+(C.T7x }u5KW 4Aæ#V(H'㨰x&Jlqґ -Cd\W ֜/|{5'՟uTů³lUm)7{sh|xtzuGš>mayMFò93jǾo2|~>ސxwuDZ.`4ţK)ԃ3QLʤU;22Mx'SxP]_d?V{ImJrDhE9X:#N륤 ZQލ[>Ғ ?J!1Qp r qA뼳}ݲ_I+N=4mwI_a{e&ܬ7wHd~JUR8,tu>pn_ `B Ex$w%v7 "(@6G;Ȫ6*^'R&55STpKdW,%ZORE i@Unʣ~5F=σ1; rjܕ~YPTk!/p3O'Jwp x.[[dqkɱLj~EbzdSI7Aoƣ,~/INWdw|o}E`|¸7q'{6~P'n|I`g `ߕ,1{Ac{.ep/:G&E6?aQAǻ5x]6,# Z<#/)8Hx1`=\̗k>0XzbGR3 xs[<¢ k=nuBI*/\_ Co:%YhHT+XƔJf81#oL$1sg3YI,JAM%'TÈy(*熡!#-l_,cd;u]b2h'(m\3-2+ϳ>{V={%܍uaK23ݡ廏fa۹ҁ6zۅa;LW&cC,+(=f}Dv7*=DqN-:Ǧg$?Zqs‘Z]ymMf >OJ]h'g  Om~xÍ=|{ /͖K㯆<%o\:sʟe~ym>xuboude\N~Xnʁ8#NY2>ًKDah<K ?4>l{<40p{ 7\6`yUCK -KI\3ZLv+;6(xZK:>W=BOhH$eN.ij}s\cΞS8v.x< KNw<[K'`OQ%_WħQ3}z>6OuX!ݏ M{Faƺjm>/3 "Ο9Q(~w1+&abK2ԡ{IZL*s|'17:8~*n Z>c׹:V-_OJ Of'7 RjQ4km'gϼdL)Β-yGPۭy]&WKZg)8R[d{$ @xIlʯr9l9%a&r}N\|< %W0C$ā!uC9^VD0J<PTY}Cqcme;&˹5+3_dCxt0CGx:O N(oi8z.Flg\i|slHZG>Jso[P.ߡN3xƮh Kl>h fԻ$^/l K@vZd|EY`"Px˃}wU@11oRoC_Eg gC5KS[Gg7ikitt@^m ɴٷ`~OwMks>fASx:Ռy]SxCNܗ-6ͫFH <47L839pgAYYcި8DmþK<օ}4v\܏z$tB̪-_s[㎚Vp|mUplopKЀ|1,b?ױGqM j]蜩ͳpMt:.9}tuCKq,>ӣ f8 c-SYP;hW\-25"X|I*r޴ 'ڜbV1돤_rS1{Nt1o龎ei`UG2:R耗}1m:6~eO[G9M J@ P(EG䩖BZS;ӉԮ$SzطRxf/:KrI7m?}1ZvC_?U91x3v I?; JP`>y K;!C8x=U$8̮߉p_j{%ðg|EM*WA8Wb3c} ^' a%\c'tX ͕g8d.(  PwsB.bm0\g_> TVҵϏ?&V 1nU2a Iq_\eC~KZ{'Vޖ%d<7<7&&SO$9rq%~>+'Jӽgz6vͲ^aP> wFA#$f@ "u-h4GzM(p<ҵ֥׮ Bz \RaO-Y`6B/Aye̟P|q[q=g(Y.p~| kBlE̹?u!Nljl(xO]=w=b;wÉw큗5HW},Oy_=ZË2l+{&V }]"1}ڿ"$]fY Xo;\y(M/H ~#6AN<Duˬ8Ӭ+rU?-Nʪ_s쫉`dU ʎ̵Ęz"W*qsz^8Ka:renRDNؼB} o:Nd.yϮc79?u}'틨v ,%+ ;﹊d_,.BiV(UnC{O$mR"8pcON&:,Z~7K3=V9WdžwE{nmz{o:b[iG7*e#XDlIK=a׵II9fcTA} "ltP 7%|RlD\KJcIݷ{??#q+tq )(RoPW+?@ J7QQBD6 D3B9/9a Qĩkj,|ν0v@vw,jgc{nb"Z|%0y+4'yc'WMySezeSO۱'o7."~_M=]e<DdJ a-8:>jQƷDݛzd;ĊoC bQ4E5m;. X>"@Pa#0cK-vC:T} ?#{ROvhg"2HkfwEHr?qnEбSOPT7V[t؍tOBhWv*\7)DË,|FPUb b߳W\j2m1:'he>Up7}ϷräD? _-*Ya|HZ;;g퇫S?LUhqԏe+ *Hs^K] \F[j'1x<榿-Av$_߿n*|)%mNdƒѠhR½',QW"| ,478_~ k?~N ?Ŀܖ}~8DGE8Yt4vi/|`]#x[<k ͚&cqU's bRkh3Ɣ{(.jTZnB>a=Ƅ,ϵt(`̻L{Pv|1Ի]* j _yTGv8<Yۉ~gNi4hyk!qv{0K c2 vKv6v[ GJoR~D;qMc{ײIo˼UpU̯%MKozOh*I^Z9dNaYس9]KVb}~:_ LwYK`FUQqF0[+yЖVNϗ~~*֧~>A}ðZXoHt8o1$vCBDoY*!˸ xc׏^Eӿқ.oLDB@P0,ݰi^eYN-fnl0|I('X5a-8-إl9]Uf1iۊ6ƃ@>L':j3o|m)›Bqf"x_ c}}ԅzGI 7/xI/e[)`⽫ybhnKZ #iW,|>'?JwBZ컢U_H УGoic=a!-Ӥ-/M=$1 YJ+Hq~dC#xÑu(㜶oܥ;m+ߟpإS qF.W}l {?;J2}l'#sxݸ;m'GaNпsc8PAj&Lc Dyc6H q>775קh+>|qs;hMY{a%{@=~~.b k3{X8琼,~.2 w|1|}EkҶH{nqw  SaھG.{sj#m!E=j_׸-^"Üh#༷ObsY{6{/H׶&`+wK~=/})G=JS^2rfE&*2&;W! Y`g>#%㏌)aq\LQTLCi3kbn—Oվ۟G"|:{Xp|`~!H%;)S>[(\sL}sތ0Mʠe&e]]Qk]'|Gz:{D&|hYuXuN/};;ݭ~,iݶ7OfqfeU.5O) ,goy7 =gn6\iUk} A cԘΥՓ= *!=<s+)٨h" g>@!#<6$ʲ˓{e;ޭ5W%|`;%ż*ٝwYHgV(~BJ&,O;ai V&s& H|/+EӌAp$s~Ӌ0_d ҄?e0cC,a/ @ť\KaglriA obWS04m$q3b߰}r?M\NIjЦdDOOM;[ O73 Nif _<ϵq%Ӡ/H͸K7oiy1ˮ.UKL 3/4-Cr3L)Iey?{F&L9_ k7%x=~e]/"nGMZ)$.a08v#!QN-SdI3v֫#ve8* ɽ`>}Il4O¹h(h`ƍK)6yV7ً0P#3ԎM{<-JF+}:q[L|."j[h;F=O)~IedoۋJ} W;Y= Mop~Y%ȸ|=e'ɏ=x,S{JNEġ (I (95>+2rôb?/_~f'F}$ǽbhaDMI|yxf~Yhʼn JZQ~Hpƅ;a~SA̹yZq(َ}*` i{L5w-bO8:svmk*\AS!|Lā*(h3~glw&_^ )/g^mY>= 멨 9by ~ YDnVbb/g}OX}NPou eXK> iUSj,R@Y眅 lW8cxn  ޸ O3N;hfbg%̀/<Utp=i/lKw"ZS]~1h[b`f>zPzXƝT@/DI+ҀvW_H㷞l|I|S wjw^p>J(yR_$"hŗzmOq.%n\h~+ cֳ[ىP{M_0îwkp5 'z&iQia7u:l-kHK:o0Ŋ]p|h"n(*V]˧iCp8dX}d9|vibG]o'n1u}J*07ձ)|Ux8EE|!gO}5dXn/i'>Ƣ{tyC|` iۯu;ES\>УeGOi=2 [jƟΰ 7d}NJ}+֘|SXBT$ Ƭ?\L7A ~~sJ7|JD@ICO&iѷτUt'孛KYJ`̚;:%8c<#sАvLC:j`8Xpr_2=6q)} O͛e;?ޯlW뙜r?l0JbL~IL* 'f ˛?7d$NWY~_\"jH%\>q;7Qq"ح(JEHpYvDx1RyUޙZ8rk{ qdc(Ŕb+ur. We8!Dyi9>`쯋)m2*3/$x+|]A仃>j+o#>MfL1o m9?Z{|c/;gs2X$'Jw̫4suRAA,~T&{5@{|C,~$8uy̓p{F3XRrL 4!^TajY. i5%]Ig~h4lϑPAd%`&BF|Pg+<scWOw8{%93Π=9lOm;TW_A8gNl4P穠IW Tz-? wkH;J~i]KGa!'N;8-,>fbelnG ɩ0k/_>Jׅ} ?.T<$FC,Cd. Og[b)68][ž[jmsnVsXٟr4=EKg/ksOO'­ۗ>scn# P.b宅O^r&ڈOkO&BY2_`SkU-뻐Ǯ#Xڮ0㋿+q869V`KqqfA$ὔ}ti^it MG1.3$2Ϛ Sip#徖{V//+uݕNip[0M2ץ}#^d`ߥ~ۦ/r_+R8^ɢ9;]}cw΃,,7%3`viMDL-;h,=Tbwf|5 k`7*0I+c ٦R دg^O:U|j'Bu(Gkݿ®"^3gu|;:\xeE8EqM%Rr$h/;Lbsw/CJ\[We| "6[i4/hH+F \"{32x "{ݯiYx\jQ'XN+{'_Lz__1qA0[no a0?_Vb51~_47Z%~=G!{AxLYbiz;,זi.?z[Dy?:5l^?H}UA{/DTDri1MCz ]R/)ۈ<6q(>-/n%ڪ|C\Ÿ$k.E{狷Y_:}*S!pˬh<<+S_q_~N-mWVY+̿RJ<ĥNo%8HPFo:v wO$Uߛ ޗG}/v&?2VFeP}8xS ئh;3#v+ TGC4 E~~ΤHʘM@WCANB?VJ8Oy4(_{:1W`aGA̎x eӯ|6xS?~?}+z'ش I'6Mk쎿r]c=3 ~ծoնzz|z_1e~vϗ:;ie JpξpdR\k گe>V MG%{]վ{[ௌPTh_x@LRev$3_y1;?Gi-M+]E3o:<$iYS}R_uBkcmRnw} +;yТVT9܇*}yLa (zyEf"8Vt߶+v9i  W!3ҵû‰4&BwC<Ĵx{~k̗5D~WTmgvJ͉>3X&m2Ce[[[ex>Hy~^VU. jc8s؉m'>8˵e8l$Gܫm ~3jo&ֳK:x/WgƉ)AhT8Ӷ"Zyx+}K 啓T _~?KYlځ٤ٖ4^c[l`p>SmGT6Cvc۱Y{A Rr&,a] }Ep>EEr/vhD̫Kkhvkԫ<9V3 h5l+o%5sVkS?nrUύl1]yrW&oplͤp)ñ F=* y=_St/W&\[Y*֝%@?h_ |ؤ=<*^|4yDѶwO 5494 ( VZt|׸a*US^g#:w`:Oܳ}gcwy/Mc#Wmo"M|.;`G _L ZاofqyBT Rhb^U nʭ'ڐk;_=oQڂ=͛ݎy[ߑ^J|m`$t̕66*~xH_~,. 37wuAweOWlƄs~3WS:D LJ_>Ho1/hj#_3{dRGO)2l73 F "ؕO KYc~ %ft&"N ^,~~u/`FmBk 4q\a,`e)Ka&r-meB?VΘg)|8{\S W4 iW{y؎@\OySP-5dxAg-~A^G7?ܥ7Krz:[ */eEm"9;G a1ԻXއ2ǓkQKcVa0\mw=Bzmp7ai}> NϨ~"f 7F,?uP #T&cͰ;Nq )Ԝ91cƼ/3za])'߄I7Ϝyk:1N>75AUW[>3Ht3ԓeqs^&|#k*) |N! K|(Z;żEPH _"Rrg!y%bϞkpA ɯteFd(ίo=} /Sr+єsƮ=&3>7U]ncn8.wǣN$q~aS( d\ë*;!=?3UMw[=VZ2R߹K3&_[. ƛ0j{b㒎] _=OZ*9 y(;v;> G=G<}[bi69^M)kg]?#O48Kmda/;] _YDp|^}xHJ=c5nI2k"޻:w-9uBIhfB U:= #>'A=q3,lSnnԽ'* xwKSihJ^_;GsO?H3*i?u:An~كi1aL?t%&_7X /E*_ sa;`e=5@.AlB,/yu/(,Z?}uuXo~Ŗ1B}_wQşRJmPia2i9*歿_ZU"EJKgVK<\i(K=5nv3޿ǑH2qAMn _Kp!ί徥Q,%E Ym:(>Uiuί>8?uoCuf}BW v%Ӷ*CFm$?CrQ$`A> e4xq@UyAOE9όS{$>H&L XL ,N5~Dž&S缋N[Z[`Zg>@ծwcضM/uOBrHB "s:ׄi $R5qlC4~^tc4>h%Goqwz2|,FX=~?%M( 4x,%n$3g}ߗ<딷R~_8h8^ǃ~a"Ǔ\Lݾ_ 点 е%?k[j~Sx|AQ1]{^?-i 6z6t"YsM]·$Sr; ܣhaa<~\:{:fe`]M/Ҁ#^w ?߾+ ?uN#߈\LyGw`sIc/g[~qU> 3NtZrƯ:&KqOB+n_##=4?Icw!<2 Ӵ;pńd4S}gǟy/9]8xEOyoqOS|~G[b#֯JhI<̫627>L>}*ȔL9wQ{uU'W @h4y/K:k߯ˇse}|V>oMyƓpdj*WҔQ2j߭Q!تL xP.Lr?yiu7j}OY~anX3߃KsFG@^so?tzA0-v[ c.{f{xz; ML"?GޘogDeP抖 /'Iu\_XƛDŨ%0M1^ QJtMCA|5` ^5n`>/* Z{>ԗ~}A_9>űZ򆃧qZ ~r?Ƶ߿=%4?i_7}_ 0#mcq|=O]o._MgD5iVɇ|Jg'}+;>چw K*$/jS@>K G,slyc0VS2:&mJt0C[ d]Eeu??g78.c_b}[̴}.[If^xlֱ :, \#ϱILrVuRNQυ /4yRCRD N4U^xH~!tz^H!G CZpv /\[p?GA8o|8 [%dz[-6MǙ 8fs,ݽ8twv8yh?MܣL;ڻ~n oFkN&|M s;v:ϟb-HW֍gJ_߈d$@oݬKC&jݔC^ZDl=fgs0CFaIu2\⃈s:v;3 _hq(tE |T8g14-E^|OC} s-J ~.qt 8'qwv迗 2\%p`" wH\\JAoWNőשj1ڋ-:KbPġPj1<ӷ[Bhѥؙu3L/"{};U߯ҋPć9rSUN92\\]\G{Ѥ{? -3LEh$m*p?x:h-̨X>{¢3#e{lփ:Ī!?JEJRdFA'7}YCVQM Z*x;;:ksHϏ矩ǥ$"*o{v +2` I@KU12X2q~ׇE>t0Vc%##arZKAhS=cp[O{-TF\<z}|%ڊwyTr6'obCJ@O*XOLYwt! !iG,)NcWj`<( &6qO.æsú$O&%x?hV1}`yMv_!k1NIҧw5υ/v7IdG(,8㜻|q6z WʦOw9Ⱦόs PvG^ s#O@ 6H/A Pܺ̽NyΝ@{FiR;J+kQU9ԡf_hJ~3Dz$[?R1θ:!>nU^BwYClH^8黑&5$+xRw=HLmu`~<g9|#Ot|<ӂ݈0:u4#U78TSwV3]s{XcZEè%O ,j|o oC?ÞQ3Uy8D|(ٯ|(Hc||AOn镐+; J*oN^B `p/#46Oc]hDW]Z7],LD Km0.N_A)wbFi|?vI˼S+'Є1Ly~ɰ\?ُ`;5cm୞b<#}lwkǃ/sG/v_8lS|N4ػG9:18|KzsDd[Xt,X]395 ]`Ri:vK(Lsj3zcQ >^Q߁,%][LZ-.MrO0G/wWV4Lx3۳n;t/Q=e{jʜtw[)y8&VJ&]q\ΗÌGS|Z?J:yft-$amOΖqXXV\TSf14n+v@s]jL3v?鸹CJS^X7q~ig. n%M`̂5b}~zØ %%ZIU޺Λ - $ F!jHD;R r4v_ `Cn^ROXͬJ|fԨd<\ھzijoC9տ"'";_"Ad\ߴ{mg{OǪ|Aůy^Z vѸ҇ih.AM {ϡ)2)ygF-q]s^;$\(NjrƗԎ520xiu?R;~3u6sҿƥ-x,Qu5=gĭR7T;;bHJ~ }nV `%Pw# ? Ni >̔$A]( 7GemoeVh#4aFp;pV=_$,jGBp$ߣ iÑ(m}s߆,X̑h*#/&D'u|Uikg $XM׆U Hwh%y"@O!Gp^ŶNIp!(Q<^C߯VBpR>J>(a""a34\S ڊ [B;;><]+aF]j(O)v@g1h e8MUIFsqSJ~mKuZx`VÌ] jMf`Wm%ּNO(F@~}t*z.$rp%@!{jiL!-SJᬅwOQ-u8.TN+KZS05cpk-|k̫+|ߩꄟ_+FRW}F/JU3FӨ`;ߛ8z/^vl쇿wЕlB;WbaCiBuq[%8JsXj.e'* pKnfzW >sS"$@X͗a{ *M"FPіR<+}W"oZV b ^c*߷yLŸLs~8/%薥mkeĶg-c&Gț &LA0O@ʳPǗ$.2*) X_/ ,1o;q ^ TMNNj9a-IUx[(5pD5 0sLw]o+S ʺ:N`5Axii!;n}-ꍋZ֣N=)xџ:^Eǵtg+Έ SP2viw@W²[x_bt?.a81=):mZZ&,sw+qA"98M! "ao_'qVM?7~ m9>YE>sJڪ%=Xۻ=̇ V5*xw(|V=`'hLa'" ˺(/WUP@bS֚2#E Xjk?xMުQ})he H˭Q5.f§fEN8y"r)# i8v\U-<ཞs;8cds`d v|=L! )l_b:e!];cFIJ~G??a];S}ҵ:u$Z~C-iLԺTE;" n_HYG+qˎT?hv~yg2(YnM p*\k:#t}.b gŃŴIF%9"G;|Z>KϜl ;Vy&4߰dhֺ^/TJҍ͟>T*ݎة#}0_Ͷp?yV$Vh:&u R,n(DTc<w?DǛ˗jt~xMy8L֔By4(vQ#>3MOl;Ddyk*lYXaJSaTe' 7~@RtQ81}UP0*0qiRY7{PA7'}W `4GczǍof+nܜ555q_S)WLYm~{)\693Uԉy[ȄM20~#Xi,xߪ7̕`8n|>,E+<;r_A/:(x>z߭b][v:\w`M0B3 Obj.Q8hk;wGe;oc1@J!*7YyNk^ɷPP0)86%oϏ#u,M҄MJD=v Js[V@b}[SٌCr8ܗYs9Jq-a.~:J n!ˊ>9ΛP~4^֧zPEz=d.O<]h0~ʜL or0nxPJ_:ĂUQ x>c>;s TqH,{=b2{!` ״!n镫~f߳3-odw/ԑĨ{27FԮ _hLj:X%~s]nݑTf\?n, v~uUf5O.2 ^kA:j'ھjZ(ݴ}<xA򢟩ЮWύu`>+&'*7hcW7׷تVGnuÓniG E$Bz~,6_ޗvz{Dؾ P%om"~*/$8G]i'u<g,7w?"Ԭ[O9Ui#u0n-'W$ e {_:/yߴ|ϗ0zUv5-ȵ?+ _ECt˒Fb4cY%,jѾ/xHBC(l|~P ^+C( Usx56muT0~mo|b3(%@+Yuuvcj4<s``> 6p M4384NmRps{Q.iiwL/>|?07F;8֧狻,3MN%~|]8F,\  pG9Ϝ8|*jK@r1g^߲vJW_1%g ?a Iݡ<-su YO,uag={sӌpp1ĝe;h'PoN{FT$kۭZ?`?f]J/V:-|KMZ 'TnhUϳ;nhMY|-?G+D#Ȳw k>:vjʛ,]91k2n-).@"wACemvy_i?% pUfMjZW^ӤC- JgS>b{8_vvs~[y:FHtzvxJ z6'-h; $n%2Y `p7px>u%t RFiwc]uS(y,Qb Zp8FU5|_ix}Hw+U(}uϲ;{Sqf1B {+:m yD8_Wߴnxh0^õJ`w-x-$}xV;a=D'UsKu܋AK%eOU˕xR}n>LsfgLH8JI_|`OqAa%դߗvrI{Ǘ;}kl'sɃStYWLTZŕt\YBn%/mjG A v%Ӷ'.^2 #1%|qIp[/|@kW8[vRPu^efU\>K`+aKvf1C"vE̕S׽}[/4e$|P>Aey#p&!7oގKx=]a]I#3`(陵k]^P; \D0v<4 };F狓ugܻC^ .:Cڍ ! >cǫ[HߏijDX)t+>cF?HwYG͞sdG4.U&$ G^ϐaR!}( 71ʶtZٞ"W9ܹvDCN\KM>*ݤ:SH:*~!!WjPKJ0W& _]ߵ9-ߞ_67tI7c2oЬŔ(B4>^Q3ITr `~I50 gê.<ܟHzYJXcJW׫PO^AAwG{c2ց.: l\5{T?Y۔xk1vo,=g߭x]uާ}O|ovT@*xy{$n܍j8feCw`M瞗9 kE=yCp`|(v^jʍ޲ް,rnD.q<(_`*]HpLsO0n >o8{;2%a? |A21|;6OӺVs1 _wk1k$Ax+X f녕˖_Qo0nYl(--%?)cW|BFߋq3#wRH ƞJ OpglمܳUf,H?5O|3ȫt^& N ȋی@C"lxĭJYRql)[?[+/Y@5׳Mǘcqgɭ}̐ƣ :J\i4<3?u'm`c[)Tjj,Kp/oߺDE./9AǷ)/0IlI,$,̺Q{3zoja(=?H;Nʂ^B dwN ֜@`&D_X!`uWb?>B(AQug|eo#bKRT@s'a.gu^td "PޔUm(ĕSk1quL+jos[KzezY*m4qZ,][ci'v◸rwL2SIk۲შr`7a&(nZ~J4޽m.99'ScfkEv#[+LU_H=Ռy{»cq{߈y̝:'ǘ9t0 wOd)Xy|OASKA(GtFϱc?KJY g&Ayކ#ʛmdazﱓmek nĻ>-oKi@Fn4wNIߩY(`hiG}Q;xnU6A쏚B+yG$f9nˬ%|JJ>R rkw7r cf1<80CO\b (wGt+vuiԴ(ח6ϗ6*K76}Sk0s>f9ˑ`8eŻn!5]x_&'Ы 7[G;1k;>a]|GL|q2{80#߭Jdt޿~ByϼGS L\w I *fWZl\ZQ|~B) )X:)֎Ujv7%q'R73Iwü?~]GPZppx?ߴgF,.x/Ə`Sƍw—>'OD+$-|^!(Ex}ĝ} jg{E? jS&/$5:o?'7Nqe}&S 3҆~U;Qn+RQxQ롥*ږW/iҬV9|գ7g*Xb,Vնt輏_|Z9]!ۺMMoL<6Hz`Jy~* K]XK#+mZ{XD&;6|6zC|?DbƏ))q|)"]myle+dv=qOBܕԶž%Ѱb_*Q8g]/QiOQy~;xVδb5I;_<Vdn-JSCV ҈r],WawCۊ}.ȷ 1s7A դ~,m8Sh6E;l%,KҹQblbDNS?s}m-]vZy+^7$h軾};%S7Vy4hD6L~vXcb*r>:GX;TV0vf8`߽GĢ?{쭞8HZ34B\OI<)KP%|%u9?`!DrOjJ7S7t"η | L ,&+{lWRc?3%+ @.2hWUhmϩ/BG[SMO\r M!ὯCË{B#9Gs['zybQx2;:ectذ_q~N! ;am~LFbȄ>%AooK1xYLC+e2x {\}rei?xr8cq}^զ ?Z#:R(NVoŒ2H*ĈRN-m^Jxbge}q ik~CKE=xRpEt2 \AYM>>Bɴ9 #4Mz}{oGo*ɫ~wm/;nY؝ ތֳ~/z^Ú0j/=dؽ={Ǎljŏ3qA%jd>)B'~k5A Dpƙ<y P3/sqm}UN}qqcby|x~-xL:408cgv ~xТ1_wW :ip%b^o{ .-6$+W-!ⴶNN/g6(|U}ErkӴg>sOEL)|k?}۸+58)1$]G7U 4bZ Ӗ n3ƌ֔ZiQp[QTyn[H+;知90Wfnb~DZlhT? 5RaDr~&/Hc: {|kMbRq>*_nZޭ j$ LQo. BP25죊bH21{;ÔCa\nx`?TBW{o7OQUIf\Vt[fw جse ug?x 0qƾnu/ 3?ֿwzqM<^Qbثyn$|`?ߥ$*:o$,%-jUFV!h~Ee{eezUT\ ˽V\?xt֗bZ1i+{\jx0M.בvuS0`ED H$4Ol ,In{cۄ-amEkq{R_:nt?V]ͻ?#vyȇ?.%x|? #B+unNyo =;ߏgz֪K}G"QQANyhy|f*cޗB`z~'3EƳ@.?T/Wn4oPC:HwF4K_!S0o&Y9xWn؍0I z0vC _H?Iz{W#eF2Y')s {TD[ fϠ`Ro+"֏`z.'V\4h~xKG5u:F~Ni'Ά\%b+kӸe[GGh/=({K"?<`x#s\/;; >Y 'x.$M'8.傫iӓfO9'єBa?ڞ? !u>:'QiwzGg}'{3t GyrCsc Jkmt&"a-y.—Y6'|1SEܕ/V_x?K_rl7H{Y9_2aBX(TqEO=/0~ط` Bj̓Ʀx*L : EF*j3>R1HG7FRڝ)/P%`/?dBNVoL6b̶xHd)Vw0} ~`B!3/.ncokC[orLq B nn$h4 ̚r7J ߥ؎ e/&L'F( o2VzeKǹY{K).`J=IOtU9ɥ(K|r0q]]۔qX*Deu2su|/(>=ᔬZ'0I} %щ:4d|Yb]+^l&9PAwµ}ʙ٦; G[N¹ ¸y oe#|Mv&[:Ir<.J⽏x]Z/p4ϳ(~t B0|대ZJH-}.6}58yx~e4>QhswA s|~r{9 UH?]5_ r{v9d|Bm$~D<UP46v{NStLgc<)~z\mMҽ("-9I h.)=LeMV#ur!c&In~`4l?^iYky?Od7ϐ$-R9 pd 11LdO<߹< ׍wt!փK'A-lpGLs`'Q5>c]W!&դ^Z 2:oz& >?etkvcN|'mN7e’ѿV/1|3Q4;į~>W`j9!&U>Rp1*ҏ_ub9>bqm9"Q<%1cY}UMƒ~lAw38%/c[U:O:c^}nkoŹƱ`>"MixոJwx"usg V#pͫU}m|l^h'ͽyڞ͵p@tusa*l?X Lb!=O^¦Ul׷{|V(CxAyZzIT.9:K8PA (&Jz:rh23A3&ST@c%js]Aw0WL:o'@;IGq)%N9NapW6zc ʗ=4}X!'^b37Qf_64,ng_7l~H VQ?|˳BCSR km'D~K7\R=pj8œ jو2W{8uSOAmr8Hxɏ7;){2glp{Ĵ,˺턛eN[)E.x*$(9 o* ;fQaWj@ 8y2Z_&YM7={^>V$6:%C 3<^}fYOL}lUm} Lٲ9~[-,ckAl2?1!7 ۈ:Nɾ7.LWLB%;U_3if67AD@S/[ ^q/\ S{&<>0?Ew,S)|o3{Gڇi`FyJ+a8y-{XPm{92^9xJ$.!g~=W.+ކiɌ^8UbU yf8.9u:Oi wx7?8cr2^fƇ H4hV+_V/{XaS~qe9[`ðA`)6Č_P}_㢃qχg:)7-&ŵ|@~d#sVPHz<2cL1^NĴaIJjx)U:2Z![)Κ\}W2=4*"b [$VoX*Ok=77oX"H/<#SIY=t\ck L޽cȲW׸<{~zBgAbOUDKCbݻT| M;UM== ޻ԯϨ,t߃y>fejOڧڧ":f,;ާ۫!|KCBx~qQ gO8qe@:a̰@ Ii_Z<I^5+5`|.vֿ=9%CsHBgGLW$%Nָ5EBt݊]<+Yq:.908_+ib=%1R [|6ߐ}w #nMzßR{үho3HӒ?͎w~Ē hLȐ  V2*iSToT[aUZ <6~{+%fʂ  ^"-&Q"v,'^t ߐ 3D&{Iץ @=9'ΔmZDRXp~~13`,qd{߱(`SWmB&{|'O#.4s MT^ n3ѣ035_!SO xڿ,Z%+r:naa7J.򍥰m]/!gސ< vNHH,ʩy'R|#)[{\D< X7u A2BwE1&"i%_+"F޶e0{qQ|/r7/0D:קA,wʫT,C̫!~y|wَ" '.i[_t)8E`6qM>N_ R}g[c$x xSܫ[Bҗn!~}GV@q /ҫ'2w%SwS >8[5oRAIDxnq(+t8ŃӌmO,@ 厅]$M?k~x\WCSBj - ?fB7ϊ 5a73l=70_"{^ ~$U y}:JTHm;0~K%bc 2$$i ޶$V,8TN7>xM쇰i(0w蹁#v{%`,Uwx-Rr}>I5q5/NpOT'&y-nWkZکM1*=ܣHVxSvae8vF5~'w^n+/ԆwX}HQVdYxK\5F ^GWjj}aYN$ĝגC-j$*S%H+fO"!-1* ӌ{I~O^\?h\`e>qU k+:OxX_ڋ5J­2'5d= 8Mpjn߃ =C㦢 H-ڪD5OPtP3uy0F]>)ݾp+>OJa:Ns Ra]/ BWwTE;bj(A]oq_0qsϚx⼠j& Qhe5}c9oE>k{ss:o]q0?y*;/}n7h^?bU~ОugqV:%3(e!Zr+'f~Ys~4,Χ*yr~:c= |S.śTd_f vgY7L>}2%`kWߎda^Z,evlge;GM[=jѴiQJ XlhǍ6+.@◣/v08BuYQ |T=ݤG>URGھHgv4t$Ѳ_-{ai++Z|2g> '1lpCw:Kb&DD! ǺI.,_X OE9D Ĺf֌AgCZ7?wp#0Z -b\+,k>Y*ߧ8WJv>p5(jeoj'RqXkjOsH=O_CI: oTWsF/vi^̀SnqiBADG#Wzb.UY׽o&9y#HMGKWQ!Rݱ?.yVY1j7 gJAߍtvPO':8x3ćO3Xa-Q{B0;;s8L`3 rF/r!7 ة0گ֑a[W f`wT]}eF~®%fML-n#DcbFp0&+x̯ˉ;R0y"|-9}~ﴤqƉ~OR' 2@zXpGѾHu,7fׂkkH/ : G.B>-ENd¤DTPGp ˆ+8o)QUVض ͌sf@ <'u,]ѡ+xJ1 "+p~yuy_ 0ϳ1P\8R.nǯ2OJm'|վXΣQGĝ}n0h37x9߉=ϧ/ʉqD5R=z}s^7 elyOgF!-Ñ5 fDsPfԃx9{NZ3nSyDq'0v>҉Enc+f[QBˡ=^a#r>\9}0bK} o nsVﴮ~_U* eo){ x}'|R./2"yiH*Nm瓸X\-NINfځ X5p.38h5|sV;JqI ]%<3nk 95Z~(Q*;ởu/L1CjKYb^>'cE^-4oym~NqDr85qMv7 *VR;9#;*Wb-qSg ngj̴a ^1 ϧpxa).EU` ȿ ~B30FbT"CN~LG鶚whs|2/@fUWKdy3ƋDXUOQliӶj Ҡ mͱzB=!0C*"mj<o1\>pdWjmYr%IH#޿x0Vnj;$$JRtĥg'Nk׬M2Bi/|RJD`O]J,QƸ_͵d`v̀ǯi/E׫9կs# o)m}AGp0{'75=7e2<懼'~KT3˕["G1&:GM_v_.<(s7̏fWaF =o+F2x-KD%A=MzתPiN{m'_.L`=[D"Kb"mXw›izIԟD;Av:iܗ{A)$#rU~bkQ8(*'{L{>6m`?yKQ?=i:Ҩ488u6P '1=~G״nI^SdydXm]gUOzVͮߨl}Sn{&TY*W e qq{½~nuV v6-$'T@Z;.j9i]9n)c X|V!.$A+v7D#/ơi K5w=Wȣ@ݵlͣ?zĊXwf&W&Q%By!_m',W 3!fD00qʫ1}}b~$mފЙb| %|7 yZvx3"?갪9N|ЊSf:]eHg> A"LS!Vmi?|*mP?c~҄t${oS珕NsĮMm]qʽ*?P"Ӡ:[k[3=5z PU2mM0W3 ۳Yk>.z;eeȸJ6s%&!WjXgaz$TFZF ˅'뚂tO'XE)Kr/y9o8y`2l7fo .!wYqPI)a. R}𽡬$MPYڎf~q~>=¼Dyk*^6bZR &PV;$eL! ]SCx#״f\;r~j~ĺ: +|)|BTx6(-~;Ü3<:דȚTxwVJ$jP̘ZuyW݃m^3]׮>KLb;|DM,Ȧ{-i.44W;7 pd$iI_'[מ b!0=?W"9%`N@Kk@\A\>_)i~//Z!8QywėM}pκCQ`m5ċz8u.l.rsxbbzP l,bUZ?W==KP2ǯPYpxlLx7VNn`K[n؃Z?^cl 7[EZU//rqkC z߷cp8 X{&qK)5c~Q,;=Ag>@;|ΎIٔu;\~'T x\neDmy44xPKme!5~e`49^v|%vY QP~!iAoyo)|tI'aŝ줥ߕP{-R<Ǧ7Iuݠu6՗"8#NMnT{ex6ėS96e(=GJ u8o.H%s}6qP-Uپ(uYHu]ި+qHw*3wH}X MB~إ -gW8\*!'o,nzH^sH4@y ;z%\N gd<ɤR35J ˴Kd'3P,~zIEݜ>%JconrSIVz92W*TLW̆w36"t^׽I8~cm׻z3Z~uޭ=ww^k^z}[vs’=/SƯ}bߤ`s%)߉㷎+D8S,i/ح;_nDy?+ަ⍳1 W G3_aJh/;~/ 0*.-ĠRܭ\8;mc%Cܡz7k7/\//zǯ1K8a<2^*eM}G4g<엓_OgJ֎9KI*!ghva)M*`~͐K~p`ΰ.,a0ߧnPf" ֏C|D9#e3QGY=V}`wwOC?Dʤ2q0.48WZDbt龻8.y P{,pSyK}wR-ם͗m~Q G`vYqg&007ӞUC0xkN~Z^kL{ypQ9 Cc{e ~/A]ZxP|k+nnZ`~8E5֏>y%U~GGvdWײmη . ۶#,҉E/ĐMZ!KbpE!XNZ-bK}^D .Hjc,7Ff ~?bLaHHДMXz)!3m<y:aGxBwI`oj} ZM<l6#` er}e̍*!Cfl9L|'ylwZsgɐ=?ݟ&a8aYa%׫2GyߥN擾TƑcUHb/Pp7.1>T~E]s]y$l0I^xK "hąWI|yI)`ː0 Ư`6-~66z<,N߳}0AФf-y;iLG* noj K<Ҙ6'/kwZGa仢Ȩo^:(}RMLc} Nn{|%mc(aZM]ax93#X;C#Nz1tUw, SI7{6Axdϫ ^3 я8Ŷ*?旸}iǰ},~Tޟ_De -~R- BV ؞ˎyӎб++م]:q,  Anr0}T|7.tDSk~:q4Z=8*o96Fl¸ϳƻYEo@_rPŏ1X?hj*E~ K|fwkS[^O[vM/~>%IReK'v,uGG'e4'{ YZ*<!@~Rg> ˍWCwbaa/eU}ͽԘ]YW@_e8o:pd5Y.8_oC!`DƇWf*Qvn~gKD\oeYm_y1$ڊ҆o7ڍko8Ћqc'"*QM/U|t `pVܯv4}!(i;u ~f3G:ʞ['m4RlrD.'}dᡝ퉞3 NPKrG2`>8ai砣;+CrOV)s#n֊( WBub |;vv:[qg&O&$!I֡(Jgzy0^딊Ľ߯t$"POZp*aכ|hj:9םW?J? :m3I`'*O%qSS_Ĉ ?'~2ds=O}'=w;xI@ՕJQ-Tuz=ѳniCc.o^&4IGb J7_ {8gGK hXP6*do1E 1X#Iؘ_ 7G9>c< (ƍ|IPJニHv(eƏfj0'm7sb*MØA+sf}UrQ`Ca?SJ8%lZe~kqjuxf3fޚsl7`Iό# ;KMmE' h/Au#0qܹP}i+v4`'tKYJمz~Fx0"Uy)VJ6u4PU,eL歘CU4yujt*ƴ[ó q2IƃUҎdYmg[s_A#q[D֫]t/|Qо2h|مS57k~x΂|OT^5Jy}QEK:niˇRB4 /#D" ƍvJv8Fgtğf O1[cɏ敃1mi`'8Ece'Pؤ*%D?[{"L˖XM&Gc~QE/Gu_Zhh{OU_:֍;j_f"B͸{O"9w lՎ~ׂy 󗎔~Oۺ֤mi鿔>Cqr1ӞH2nѕZ3*l{E7i hnUϜv_il))Dx =t7#;3O꼼?^qЭPu_?OG'sW&"i7z4GVz}Dd1nk ?nƜaRoTOK*w{N|G ϷEN\B9,_tt14Duc0%*Sw+2G'Ƹ'wYJ72i o|O[DO+ޒfj#?خӦz){|0̶iL)30ۯʂ^:'4V:vopWD}8\,Ft~]_=?{s'XûLa,uj_m[כxǭAmTӀ_ >O‰O՗v]fbBQ]wz/k3W G,UI[EO&~NB1`'g~=l}r~[m+}A E[_捋+mWl~% Kx8؏]:wx۷`F/t40!3^0y[ ĩZ](6&$!\^)[Zébf\GFU\^3브7DQ8|c 5yNOh.{fL &K#[V4mxs -8QS:9gkɩ(hw\q0''sx NRE׫߿ [![9 5?n&GnMjoهƒ5_dm`4.Q٨ㆼYHt#+`үi(z1U1p9H@ !L\Fx{><לU0:Kc%'%fgRRyL_~h榽)WG_I|ߥ}F =CeFSgޝO;?ALXcE|c=Y77ޜX;mo;dFit$mODwa:h'S(iv܁8cOqJH,(g|o{n}dbwj|}XЌ}P%UQ3NN>14&wB 2=A_=v_3oE璤BHIVdJNҎ%8GAf" vǺ>c@Z*>^]A}ʌ0z'7hun4% zR(RlkF&+ƃ-v*ST*;;w?MUgGۿ:+;@{&Bh7OٖvsyVU,(359n.)Q3hU)?tQOtk#c;Ժ]xyޟ vkNl[dǵ^Uf<2=iCP~k)ۊ\GӥWcD3PAC9A\Co Oɪ1W)"ӺLǸZ. yC(.d_w&GG<},Y&a|oyq^xA޲IJP>m?9v8&~s7gV")ڄQQ7U3pN:Mp:dDDd*Ѓ^P źlRi7yK i~G^[. 0)=71=i4ޛ/' 9mٺ?E -%K3#"02s!N7{x,xPi-b)*W>3҆͸P7(?~!lrt_ܴ|EҞr.5(,ov~ǥ?uQ߅ QK/"AYZ6~e۪P_]}>~Tq۴+.j~dXnTW>-|=^D*ڮl}0V\ 37^큎l65~cFIoEc^z-ݾ(LZ[KK-+@=VR6ѡ$Q7I[Ql 4YhqMwtycɓ˸pfps^Rքӆ]IX8d"񻼠 j0f'9 =w2?ꣅv6ڵ#/7NOIXpӺf3ٷ2F:Nx$@QxBޗ{w,Bw۴ˉbMj­i "⃪fGO+&7Tjj6o''#O U#Gw~ɰaT+`d5RA}1; ku҅F|Kf`9W 7TmQM E?g4.T&ǿ';C p*#ޒO+wΘي}C}fN֎Az㊔,O?W1wAل7:XVw9-aE%oW|@S0+٩Q;doU~{]t4"\7sL|m%l]~ ĆS̳@TUqs\% 8娶 CXagC%ɉ:>ݷby*=uv$ N=AFz=SNx,i?qAH!|+w6q{X{‰;Qf%)8: Df(~V?yj)UMg>L9Y󾖲y87޲/qg7wy? .WzmzdGZc0EݬOd|^1lo'@M\?q;S3!3(`Яk7j H`|J R=]#erV2TPN@\g`pޯYR1wYgz~LK<3;Hwa?OLT~-[%>ʿ;oQӱ3`|!1yr|R1,[EڅbOSt0^bz*vn!=s#`Y7GI=i_'䕽M3?`h} ED&y u ?&IR?KEɇlw+݄}((ۤaRYiGa"9W[|JA*g]w3ۜd_F&m)#) ~%ďy )$02%BT²/~IwV)9;FgUX/!%$<ф3x|x5,0(/{_VPv`e*/a ᄞP+= Oe &]DDRϊ#)$C'`G;>KPZ/0ݵ`i*$wͩo?[F;*/Sџէ㏨c>Co]J!w%8j6 elm0Җn1%ˊ+g&Na]ߥ4_W-wUx?w@A N39ODD,r32vX{{; 2PT %{R~|% H/DiT7.KOR鷐@A<[LѾW߯5+t{C(q(+;)"Nr{.yIVfTXw>uo D{8Mvvh]BUqgx~d 1=zg%; %8L ޕH?I`3KӘ@J.!Y̘1_J¹7:ɴ*@ݒ`n%|H߯oJ{6;3PΔER5 5KF >CzR$T$ m֔aC2beX8ۜcE҈SB.Y8eꢆwX^ۏ bFP(G-l]O-XJ -O  :_YX*‚PPLZ0b ~X8xcǛ=L,ErlE7b Nx3`B UhX*LݪԄ^b!*N-C{7 K&MX38Qh@/H088f9%qg&~sD g#FJ`1< l~os7u }eԀzź&0PGv`}V3 NW1{<ܿj!T- 1PMvIm42cxniS4B]ϛ7Mѭa}kw׮SDu[S?J{ț~ԉy !3rߝ.HFqM7,oB9P H?_.1KzDz.>fQ{V\AGkY|yDckMJ`SzP,4)0é(qY  Ŀ.[mz_sպi¸m\KIh?'iR &SqЅ"+^xLVb8WN>[t[j+y](*Qi'\gy3%eBfAPQxZ ^GrP`{Y=g&> ~-/l{=|sLkNG7I#)̘awW@z֘|iH, iC5J_HтwnY(Oy:.^y%O% >Òؚylu*LJv"zYLd2xݏ4V[Hu9o7!-"r.F;^MI_|o}[pmz%" (&hxI-jiIXNRKL_bq/0ɋOӹSK{Y~1 M-Mj'9qŋQWUBwn * ďVJ۶RQY;}FG\T'4{;MN0~7>;~oubM}gZlvQW!BLxez13NlDEBZWy`kT\:c39Y6佲ۯTԬ􃻈?tVد*Vt^v-)_w]6~ru&Os<%qb}$17dt?L4,ѿ#ﳳajcmM{`f)Zo(jGPˋS.ynSo~Q(?S9u={NK!i 2]^a_;|Iy^Ʊ]̷O}|o[RDw.D#N{k_-8 YN8bG4Ny2;\}_cTSC 'pKD77=1΍f+FƆIkf\QPt 4u~V5bQˡxMvh^[Qwgd3ywDϐ ŏN?W$#Ucq#WpqMv KADAYq&L v$[$ `j'O&lz\ :bĕ1ƒIr}T '+WK_DulT;%c&o4ކC-ɯ ?'Als[Off4Q{M8o,i՞'m޹?+# m^J܃&xMoVarxzѫ\ `nO?ݭU?kL]081٧͡NԮ wB}5d )!s~7`"[i(2#oǾs6$^մ\Nc`oguɈ/|/k4Xt- ̾{)`z+ZIG%@ږHLXNUCi:#3}HN;2+|̴w*8ij&5{ZẐe{.Rm?w.lpZO׹WܓnTeϖ}āŒR{Q/f-.s xq,"]\#K RGfo*O?oݓpߞ*쳜d{7=q0p?OeU\wU7 |,  I_b3,"uS|[ƺxmy”K4 -] 6(c;6:#ocX'$v|LN%^Uk|^ci4^2X0=rWx@*`z\~RT&QL*sÚ~Οq3k>y?B4ib}DIézbEg`~Ms&ʗ\kQ3OO1H_OƂ [ܖU|}M<sZ&̰ܿjaJGMt+̵$i Iauk4TjRM|hOqdl0)y N 12  qTUX^7/~Q <b~ ;مvn+&f]j;ymK vcnHoLX;IYc?7k7(Br>B f/$,}9o~܉.9b|LtT3͌;1މt=/Z_.Y|as<2Zp Ǣy.Xdu $0cy4>If}/]#M*=_j*[7EN>ʴD{e{'~T" U;k{Ҵ'Տe refZ!GObז6FY|7!}ң ơ0jWam淋2_m]׭ v0g2>VҹU탌_0Vzn}qYm+23oM^b?6VprMA.%mAv ?\T 4~(k౯+\7O%:Vv?y]'F3?^]eJǢMNnuIA#%ީz+^oZ UՃU$ObJ-1ܔkya&nlKd|yV,! K}_%bZHܥMD 惂f}Ks$7&nl/A'{M_m+4il8$hB⠏"n[3οeAhPx"X~2l kk)pZ=:OË|w`g*I%ďRr=!U,\XQJGy*L͸w"@Rn{iM@KـC;ш$}tZ=dWG򖬃tH݋ʣ"zZ A?@hs'e k9Uk}kwc +`>})T 6 zH,>W*J/2p<7ڽ̭Y >=5\ ԎJqC!'>D{5>}j͢5kYK.D&phoI/+,obKKNwҘb/ Y1\#qEOǐ8JvzKaJ+~1r|K+r Gӟe0.iqJ?>F6ޯJof#nyT  b~?g >>i:q?5J֮q5H:q# pq+N A%}J@yU:.u7ǧN7T}#LK|KW}h]V:Auy7x5ggc]|O<" f)!?(+x>"_=uj8Vo5>Y̓96ݗ֣c{ΌTg \o=a~ёklhesoŽ7 %L!8aE뺣4d^ƻ?kǔO'di`SVdfvjΧEO@_V0=8݊*n}.hS~Y 2:j۬tPuAYcqn }3x /BS*J,uqg_=>@h3Gn23۽YZ)w, v<=_bkS{ru?nS{DG\7] kJ:ɘVc?<\yyO [TV$y)5kL QTو(hw ^O;T+)2ol~'|%n%±:Cz,n *0Ik_~arwJ90ˀ&ȻZC CYaTS_ڐXqz;}ש2b_=V9;E(f2ݯh)(VI4u,!?;M ˉ7 :gˏ"}~_4]^_=Ӽب?{ټ<6 &,pG G? *!7uw{m_m9u}#X{a1i8NV67k Oie`Q~UP`@, ?-b ,T-EY)Ň:q(,vܯFJP)X(O1`O u\O!Btm~"8-3#O0Qִ3d NKd'sQMmSU+a=v\gi+~l,Ƹ> Ǹ]=n Mf[ŸO'70 nWf oi '>9aPǯޥ:,{.K0=}QAy87>Vc~o.خVgiȟ8`*9TC88 82MvO?xsF+]z4uvV ,3ґ6?~[1}{eތlKn!7A+6tW |T"~c*թSTե,W{=xՔ$9OǾ"T${9>=)^Ȱ1H{o~Eֵ-]}&(E{QK(ſ} )}k^#yk/~SBLg;Nt=QH=8g:qDSc9=Z ?Ծ7'}K;3d)bX=ϣ>.5=_S:Ҝ.ݔVD|DO+ZT_KQ?5:SqW;}gewN]׌/oeM"oĨt\X]2v[ /(T=-~Mlj)߳tpŲ[|$<)t}f_Jφ:> 44I}~^X_[k]ِq:x͝:LࢎW<+>fD2x'N[3Ԧ{TTyo0ϱ֛v\7pU>dpLy3a{^'^.yTMB=X"FW1 ; Gw~0Dr=ԫğ;YY j?Ds['/(Y{[Qk-8qW  gE|*rC^#ګλ{^'+W o@巼KyK@*a.J08zw??cv}i9 ” "v!oyT_8JNĸN>؊NN0,$.t򫙸_X9hxQG-,Yz{O=u_mhNS>wπRq=zwܷj}G5\dU=42YG#7LPD؋z%'T㼼<\'Nڕ*'~B8iy?F֍jMhg\l'uH^?˟Ԓ_ 3pOm)se*`H?~Ɨ:nȔD{9Ry`I4iWu1hMyUZ]˻F#HNcId~]r0ۯΟvջ>4'9Dɮ&~k;a yLm2oRJqcv?qTܵe܍+ؓ]T.y2 &*V׼G{i½E$*g2݊$_h9=fkQw{Ү$|<)tӯWJ2]&fNZ 3i)yL?ͦonOE /ᨤ'=H{'OHӻT6gZUr|kx:~$<~$gѫjԆciٻt}ޛKdRؽw *cC:IO}>%8VU}ȼ1c! d\ճ|n_e'Jc'^lw[@3p`*H)!nb#Io/gܡ73qlkCHe ο gs\/G:WaQet=if|Y=qfqk#˰fLEoo7Eaʌ2#Ϛv9i/or'oSfMjo<2v~OEh2aZ\o>qm hyMX~NmE@:g3H;#qP"c-=\S_֜qm ar\)YՇTF=ʬ̈_+EH=Xy'St7% f c?j2YBS>Ԗخ&Rx] 'ͭ{ǽ/Qb3b3.m'+8pg&tU~G;W Ն}bƑm|sKgU³\vf~8Ts8d\a0ɾ!w`.GWk I=İ/aNےh?H9ZƉm| 璖wC+6To-붾^ |ͲabB;WH B<|:*o/4{ $"}~/Av +,4Z^8[Od(sʹU Q`[ "n7l_}|غe CR~QM;w[٠0e_w:_πg!y~ƿ/} ؁.? HG?F|!)='m߁"])z;o z S.;XAY{#Ԑ1#~H_RH{X({yޅn]@FGegUcLUW?CD}`>[3oq<5W~$v6{w^k}1.HIV q}YVB,}]Q졿,eZUfU||S.OYb2eP%?oZhx]-l0xl%!YWَ+ʂBۏKXtv4cքHT[{'_G۾QdvVw^{KG\GvyvT5(/Jm.vU%\R/(xy~q.jSU^lE ($߾ۯ;fƴر\]T=qY| l~ e'?`OQڪTh`[8)Re<=GM=J3]wN)6٫Y\-],y:\߬qoXyK=g͢dzF}HE6[YJ7t4f3/%ww7^a؛Le}k4Yw-[,^ Ix5a/%Q7a Xx5Q'KaT$1 .7.2M? 6Cotqg|`,- VӜُ*Y-ֺT#.B5p1 ~Ćw7񈱶$Q AE!#XT Xe XS TrIąvCAˊVұ1NgeX`,a&_$8o= ::8~wדm.9G!^'$g~s- p9(GI rRgv'%@Y@ ~O>r`=VGZF1?3ɾQj%b)eàST(*Q%-b ZTn[UP{U4t2iʩ0+JB3_"f')/t&# nO8MiwiyoWDjOi<Ʀg!vK_n-NIx"Vd[,~? lyRz̹m]ҹ6Jv}M ;62;mG+WF1ƢEUGxzd%RF7{Om)Ѻv|K_Cί?J =pgN^ u}ߧu:`B a+I[Р|tSDa_az;_痹|4{By1K\!j5v0j>GX*^I)csD"V rY-$\ cꬅH ΰas&uMPKI"!i~0=DnR2ńFG2!{~[uxc+yْMoM*(*,˂枆C)Pg`=hYiu%p$]0mLӿsdzbOEd*h'uXjZG* :y彜gܸjqw/b'ZPLΊZӢ,,!~GO*6?ǛjO@:K'܉?c5i᜷~/ՔPgj`9[9“]N=7pa.Uucˇ N^jWX*G~>T8HtC]y'jȫ?y^`6ߥ^?r9uzUAɡxW/$3fcxGDc,]قSNߞ^g}~L8OQ~0/p`Zȓpø?cZ|>DT UeHJ}QeL+\G" +2yHlyZ&y<5 ]5I%Jfv2`iXoyG~#(k|&#8p_%X4eJT3a^}pޯ{Mpʸx5j<_Cav}[E_n yVj {"o>&l*)zAKU𚾳I~+$C#IV`BV ^EkTIj;9~.l_}{Ѷ49􋖑]A/=wkUl{\j{Z7[,o\j_\/ZnF;*`yo0 U7Mms?(LbϻpIkb[=v ZkTTPǻ ކx/6Ƞ-/{Oj1㗆,}ָKtox`.Q:s}_7ǡ=y0Zxʜ6'Ө ˋ:kib#u|zj杚I#y3)~9Of$e':g gyqZeĚϽUCd| ަn^Bl/j?ZKUrɘAجA *$(SyˈߙXc/{X]43||Ф aBy#oR+Ɠ'-#* we7hxG=\*Lڷf>Bha1hyXz) Ƭ9i3I߃T✗._Z1Ղ4RkzVZTx~OĞqOR1bj(#'304Xm?ya:Dt"4oΡ["Eο];Sc[mL Al'N"!CG%L{WR<J81p>?9~3aFuH .k%'gor{[&qj2PqdDGIwo>lA<ګZݟUQ 9B84)?\xd-$Fkg aYw%;tK^aKh\f}:UhGzD d9;.p^IȰbC{:м$ *d wt߇48xX>2"c ʃ'dt7w||2S@TnV;JTw$MLw!OG&Zs>j_)igl 2J>S=&H\Yd #hގbjS'X9.^eǃ#NP6ɧ}.o<+-g3#@cƱ'VNEDMLc ܖ 1W-74&q;އs^OmAWHimu k(=Ym}$X7 Z>ܝ'-,Xg~ '1W%$?(^!},\rnz68=}M;8Pt'环H|k],keY;s^ B T 4}iGx2C`zm*RxJxX&GyKvY.yUV|lb̴Kd!^7^=ɻOm cp oԤ]Sn)/:Ih | EgD.v:]yioxUkOQBg?7ICg?Y>Z3ǎ^ 6 P1 {40w3ʧ b0j=}Pw+ʒ:`={yͽ%T>TK6cQͫJ)KҎwt?cJxRAo2+gIem!vxYsv6Hdǡ\ڻ ø+eiy:\[K3>9>ִ)Ł=~gi/3wP^lɯe3Q΃fO%>nr14L] $ߍt%Yqz7(o$(w\ Ig}ރ횮{ 8}T?a][wW㼵4bfP?CjxoƱq!iKT3'(}t/S, 1ӏ2JOa`B:voKݷTaV J'm|Dzc*@u]0{2p?H}6;G4Bq1o ̩!&7H55;!-SIw'-7`_v88,ygS=v9+P'Ə"PZ I_*텳4? fI仾.䱬Q'_{#I|_/׷;&lJkLs|*n.ѫW::xٻBy:tY*R6:GOl7~W-v[P% U;_?۾Bގǘ?dц`-<b%wktC֖XЈaGit'x-#.}=4݄NEgrX{x a".8L:ʹ΁!`Sk!i"r9/}[~;Ǿ~{7o ;y:*t?o~ӢtZOd4P»{/42SgVyo>^o7WRe@ʰ[_"sy#繮Yy8&<ն,{}?bu'c]}S?:>AR6jUUoN̾G.5R ;9PzaKnݴ">(~LUKdl~0gzTp3m5n'#\'fPM+ ŇDߨmlIt3G=v‘j c]-tѤսx_ڮRk3d_ [ŗf}0V֦Gڎ̜`x0(؇Nۤ:;v/;NN7 >7qESg)X=>uXIpۉ\G`<([ E$Lw?qj( +j]]A+F+VQx(K u7rdaLQQq޿_oy QioKa LZ^گ;|CҢNd%[V(H%{Ÿ>sÃߦ]go,m~omiF[[̔u(5odvw_YΥ>ZS|ôKYIO+U _MO2<;lObo@J+jFux{?c8q8 $ <ʌ .ūcڠe<5 S?G&.J4 [k6hf8>3*À|Z=IJ3侧"%yٖ%s+$/9f8@,sȭ+Qch~S'TG;kez UKQ9X<@n[MtWMW ;b3 g դöRf[n񇂯qKX_8x1|$Ҫw̽R39ﱾ5GwaŎ ^(|#eKL}T~d?;:bvGQq~q?2Ɋo *yPƣ~]bOb޿Vs8Q6|A"eʸމ'/ pU`0l;|iu8DQ(9/ОIƻV[>7ѫ#C3s0dDxJ+VZGddqXEN>pVϸGČ}^SIoM4DzY|N<;MM~v> hKtO :3g̘&@z#FϘJ8QcªtxP |p`_ ?֟z:qI\ɹ%݂j!LzX`98uOߎu( ʏSeU W[pu%1wz9tKzRكD,&+eC9F@U#`g?ߏ|4$.=~eڿ[аbo& R9w[{ո>,j𐦤w.5Xz<烦.%^𴿴ɢ:Ro8tB<8/AZZaYZ@"i<'{A[Uڇq1æUK|jUKLO*39rYGJMc3Dy8+|+P Rr~뺩~ƚ z4-Rw "LouR@!AUݗgx T]s{AڅMpmb5&u z-%+ Ȩ#?&!JS'()'CEOY M8bn;dJAUkuccAØv8bTygbȂ1m׹#n\Tt0jhY&h#Ḗft,|tEӊi(ڪr'z~_SU@`y oxH|즞NCÄ?{<ۅ\o4>=ja~u\< ;GFx6 G fܠ0-W<;r:~XypXT$^ZDMGfZ'_4h&U}l2;J !^DAqj9+~癝$Lq\NqtO|=ͭEbɇKVŹr;+nt<_/Z;~&5RA\2lynS˯:s^T^YnEVC_ej~?p^ yP2֫-frM'gl]IVet^r+c%o_SooDtDY2(ZnuJW:+;X<~c>xyuqTr# ZxZ5T|YհGNɅwӚ rsص <D"ϼSY%j]4BS mM)9^HK$x~7<C( 6[]E1?׼oz.?fRca'cHIĸ,qSgˆqߏ3۫%̓++6=t Dj;xQ'>29ȶv?e`q 3ʝgh ru4iPH ӏ q_MAt;Aڿ?/:W MU:co|CBͺR]vM4pOzϿ|i_+5ۏ<̈+|oTV ˺ys%x򶷼](mcX! OCEQAM8O S.,ިBwNblQ>H-D!_ܸ%4 ry3{^Kj`cqwlZWR:$?$ dҹˍZ{99?4 Y{r7-AZw5 -ӄ?l_g 7n w.׺>{'i{T:3x9r>߭K0s ~ }ArcG>gݥӊK{.߭XzDv,aU/>!-nն)xU`k"_PB1tyŭcߐ˺qv!@c,?G=mO GlS8(#vq;TT%wC $ tr<l%*ARm(V)4+UK0\wjRIxnG #š6j%;н=n*PN"/Ę{2} # Μ,+ef̟ؓ9Jxkoz?IF;}gN>F[x ߨ1#ӈF"0y+.{+zpa,(sKr(:h(Y?ݶ>b"@w^7|G^hiq!ql'WvHw> q7ٷTH\Kz3~o7D7~;|1j՟[Mң a?A}PIuJ[]?9-NXpT} R1_m~OsYn IJNS1F^9f߶|m>ZH|(qw? ]xPje1 Q /2U/8\ny'ͺ`Uqls4p[] mch'u|I9zX{\~S +}8?B2e&84L:{Qq؈Ҟ_:]B\aοfH_߈~7fG{b 4qu?>8\S4e Lo]?2JA3ܶokS8V _̉YF7ث<ǃrπw*1zC텯<ȧKt-^nT}}_DPjD A7(74AROԫNWኋ4!S}!]0m_>߁0D'}CIu͖8P'~vθ)>p4Vv3ZQ+reIp(}K 19^pnE:Y4v۠8>`X>`Dokm|O̚W|Z3}V,4h7&}Ӝv}pOy%ZK%W) L { 3InGǏnݐn A.|ҨT¨y_MN#I0Dp}' E ,iJo<>w:z|q~DO5 gmqPO)t@qo=׼ʇ.:Q~8V7M~ sл :(>HHSQrOٶD܅NL8`3@ё21yo1d-Tw;%۶:r>cθIGqڟ'&71(K;N~i`|Ř 4JNXpːCc?afVSIS$˓O(^*l%u*j0cYy:=fĎS ԕK)Q@x~Kf7xh?K\\_RHN3L{{"q珁{xbϞch_9_Op^w y Q!܏5 ֤G#%Ǥ xxuv1VR,R܀(|4d:+ 2Z_z+Tshn_| 8\84+<8+lf}0N)t2i jRMR85>I{mSDoT?5sW0Wޱ!#VZi#_觊:SOgڵ~4?RJm[9yk8EǏ>DeӊR)\MaPFR5^+:A5EUe.LO^FLs& #(C>]b+H9y!s7~Gvu$8~Sv$C?PZH9º=~~~ .`ގ dI>\~MUf8*zp| lk* 견ed@\|a5h&qZk\ G r5/ !5~tX>gU.ܻY' *)q/S//'yFOD XA(z̑{{txҋb4*!խ(Ѳu!q3˯aW|?@:}UN!= >\ g;7b>fȚW5;Vߜa+ۗ3φG<|]GڵSrwU=ٽG]Ub`\^ti/#[9^Nn:P}a^rO}Ʌ:>kKyBe?:wEg{YFydG:?dsa22.KI:oigjŔ%-b?~Aǀ/=j 7Nߟ]+FaN_J WOQ9}?a#sRuާMVR~Q:gl:X0gqZZՐmgĿ *%U$L1 ⷟8d|g;߅='JJOMQ#Np*wVvš/{!mE$.ٗn*1meaW5gI58lzbEs{!4 YVUQyd`k^9%rqÞSTΗfSsۇM̩>S,2)U|︹&vqlm1"gQ{!eTr~}wզ9;s]ߵwH3o;1/>xw?Ě͞4$_iXT ?$+vc2?7~y]}GȒp8wj1?r r(#cg!XȬQpc3ѵP#qP xFb6o&R8~;_w]d o$ȸĩٟ7Wms[C Dy57EEPKX;>m?D޻ӥ&#T&񖀺H`(ֳq2|66f-Y̙ϴ91xWPǹp1I2ù/$%` |1'>ٯ%|Ⴍ"F>uYh~YR?a* V$.Vfq/)ipY8ޑh'ᴙ OD{-!ZH9+]ݸy+b ϸnq |H`Փ# =P"gKSĞN!:uSSq8gqBQKsbp/3q|GU`^ gQ$ʻ.qP EP0ȅ^.a}׍HpfG cE,Cᾃ?O*?(NjR{Dnp-ݏpK,rMl,B RwD/P:M?jlO 0'Nzǵ~UO9rq(~ -M قtB6l?td&3gAޡaü]2%'U+-pq ݡIK!52WZ|dXv6j3U=(cQ4瓐+0Ive{<;Sŋ|هr^Njx=7`C"#҉l)x";H2Gnu g9KmӼ>_9o_>%j&'Gn N|דD-$ZnlE5jSY]y !8;kfXaoB tYS2܈udH q[Yv:H$94_bԌ~/sf~Jwg?١t#=T.ud_5vA.v^8|*` ]xB_3okB#qق&". o\d&9kS[ο{wU}\'R8]δe6&^L;Q< F/;J{_)f;zJ[9u'F S3?&l/;CWLM;8{Uw\2_]\9ck*gEts7"ăӬpWr4v24}`V:Ǖy=y3l~8?{ i6tc{$kd"+XEEQyT)/G3ʿV)~i=T x"wDK"O*F }=LpE 6QPW]Il:>q^0xtp_y7~G$: C\z GZ= Nl1 @֣ª˼ 1'=†#ڽ<U5[}o"Y'oo/) f{i9pI4q1kflGV*nR#ueކ3aUߨ/=eT~6+ƞFbݶqb=ikSf?6㡝A#BfSDԊ=(܁\h7LѺ{ӷXigs~OTs˕[_o'XdOK -J[&>fY߿Z0[f.W7mr<ܡ컄1bT}&&XEK8},*?mS;t ziNqc gP`;,<6p> Gz׫s;b0boDr/|Y%CO-hVr&%F iEG=KV~--*V^#!Ⱏ4o;(2$>d 9ҕ6LQH)& ߪj0GUIfBi1B][/CoX KuϽދc7Tyw)nB.y>2zo/ S%M%tG *8 9C腍@S !1_y8OR w8}#gVН:=_}NuM¢a^i0^~:j/}zRZ4~ q2Ƴ?NΗޫe14փv.!Jgv`՞lH3f\{2z[zP>|s0@~^Ue0663/4iI<w;DӐ=??՟;شDFLްbL SNTˮL g>Ga773K]v6©܎8wI e|c]}^Nv\z`qC$GhQkB#긛 h~O ٟ<.>!.o,n!ݴ tk.ݬSb*n7Waֺ:w+&^x[z%03};؅vwjϿo_# 1L'mRm_ͭ?vt׊(?$@cr>yRY_yβ a۲O㾈8CR{K3_BxnQZ&]1>Wd0)\?P҈w4o Jfc'XU Jϗ#? )LH0X]|y`G wWyƊ6]vέRJL|8𕞐4Z]s#j)w[ nhgA84&jE.%x^YJM:٩ o.'<z%)p87,>3Z0L.ȧv$`sqYLqΟQw$}` jyER9A:"~:N 1Vp@)ܳ߈vbvw`WGޙl hMUVWIy;_%mmɸ&Zvvx~HR\YtIPG)\g+l^"+}cV3-K9w;ݝ~ضPcٹ|ma?>MZ~9eW*γ]]zœxN ɾM{|t;Y?gڱMC4UƱh/ &kpK/30UNJy?bceSs*[R ~kgܲ>^{ى2gS2a1ԅ)t=OjA-כx5R`+~(,2=D]*ke6ۛ i_Dt&i1fMi`ܓkO%z>aG?Ӡ<ǧ4q9GC0yJDkAp.@|@/_ut\$(Eb Z\ܾ\?q$910=ˁS>`35 ;-vs9ϧ\3M4%~Wgc4%M]j 1}9^]B^Mn)vcn0}+iS{=ׇq.|fu=ߺ~⿵7?iM 8vGYGD3 4d ]AիӶ-9_F߰4uD$?c67fpd q'0~|=EKEy (c~SHpȤ(hx׭~ޅ(O03x=Wi /m蠀 RϾo=*O7wZ_)_luH 2sWg֋%xh ~q"yyU Kn]NIއeJ;;NSЫC:Z.=hH[E8KD(w 'i_zU "=%/?XioNoNRv0)U*sƨ|e>3X\ LؐUQXMvL"= [YKN dt\K]H^ZJ~ zүߛc ތ3Jle2 gďS([YesX[1{|C_&vYV ͹].3(Ck{ i}l0o8(1PS#i+蒥E[Fji3&9q\¤h-ϘXi?YJ9oẕDM(}$N>J2ɒQ$TO5Dp-vj̋J_wU}zƉ" vFǸqtjI$F:a|<(8oTSV3Ϸ>̕Kve/cT7BٗY{>o!SqTC"\_爵v ˔f|KgVvɾU߻zm[ZA=B9+#*!5c`k}QŴar.MDYXuzBIvV-rE-ʗe3B=zT7O*n\qQW~Y߽oƜ^օ7ii?q4xӄ{6aE/[Զ~\`v}u0TN{=:u7~z!_yd3}ctGWewÄ G A ХӬ5_Y^U;Ȏ&[HD¤8'6Z(Si僬[-S63\T~cJfѡ=VHQߺ# fx5GuiȊL|vXfn'ݣ>n[MoQLv_(7v+!&weZV{? =;6r(9l=w*2#{wUlnyKG)tׂ%Va?iJlV!4qߚY6h GEj⦞w;]>] % e}`rŏ ObE1 [rOIN 6-O#|ǹ4ݗqۯ="3AWV K E2sI>RZY%mW mDJM/1k{k[aίNKQݥ\_<-(t@*us-~]#Ʃ}{z12{7DK8E&cݲM;4*}_%exa'xկ"鱭ΔrS=(eLOK n$#vxr_~?s_x{Z{ﲟ~hY2|oUt_(mKiIv_hGߢ=Ļݖ*Cm{|G-!, =N~kyo^+vHCvo[Pjǖ#^"k&\,{v@y+m^l=iviiz_69,&r~j+崙NQPޑi0H:+ Kמ\U5yf_{c[O~*ʅWZA|x+]UgL20a&S{5'lMhC]X㮛'0^noAjW^0lRFwYv3z`S( J j?"n. .^qCQM߫_UHZ2Ƞ\#qGW#)vs+^_Mx·~& xwُq5JmɋH G{YWc^&*A}}B|\gEMwK69oEꚨzP=I0^Hw>l/tUܰSbTP }jYBu{ H?廥7IlZCjq*8ޔ+<k,_=^Kp'e3vpyP&ÓFzR$1;¼s}P_cGM5ߥL`.?]psf\6u(+1H9>t}uyA+DiHhpwnm+_װ:J,-Sl`9tU -6.vp5 Bݙ?qa~ b s=>+ )`Y8{MEm*{+>}ַ58!5w7Y`84?x9/0 c_nWu?l1~2~[UKZׄy^ݍk7||#(Y͘TmhEOݼb&Ez!mLL>`qo7;o# l88D!c\}ҍB52!\4 M]3:MAp~ *{ājaSI+UsfX=b`wT{[҆p1**߱9FDRqS훑fWEIҥ2ޕr9N=.βlƎ_׏S<~O=rmm'O)N= W//UEls=+vQ}$N}Y2>E//Hc8!NlkK]E)26L>Y !SO(0ıDiQo-cs1ٙ8LDȓ;zplFV%a=JV,-?*6 Oߘ-~fGIڼ[ Ȱ߫;x& wI&^ݞomtxO!Y}b{%p=ƛ)V6[ ~spG)rWS±?|4lqڬI~qnC{;n.{MV=ԍ$mWx*ApD8 |E]*ar>cӇ6îm{ax} ebt|/؅A7e37; [|vOZ(<R/My Mf${LD`ikzyKQh2Jo/ б_E$~lc>NX]ùqt'~/U@Պ/7Xm׋;Sj`+5l+bsɐO bs>d MG軲kƯf49նyln](e _ Lp\s|"`oBmZ2$G449ރ.C,+AncG k;T[o|Ҽ#@7O|v~J7zFпp)1pxSn Hyl7ZNV{_ٵ nh$r/h0Fnܟ&56yVoy5ɥT20qGcPk}cZ5yw`{ew*Zt`Oq  dn| 1H}o vaRiӻr%lt:=N.ٸAVdxff|o",?iux2as-iJe‡:6y)%j/a*<]b+WM=M&UaR{}sW`|wxo jֿxbg IUNnY'TPqG>fTw,W ||Sj:?ŮB/X`[7n0zow<;>2:oqUiη"OXOQhѷD\x v] >{ZiyAya⧓ 9$⼼clGGTp[ =όPF{FGG.4/ICD)HlreԹy_+ʰHdDr~FY}{ c!,3X5Er~y2H0+t~Z#["BVݞD1 瓀5ImW{~'F'L>2N-\>ASG7c ;/8϶)`zCR}55^%(`{~/׾D\G%'7ތy~J`^`~|`lkLx3MԼ Ut2>2X,k:LI;,؇>)$-Dʅr,YKvN/zVެZD߿m[KكLpڽfQdmwI &%ū:mz4{^笙 Jס JMWcb6@9~6$bbrQ *eFׂ(lI`l%e0n &|%I]Y]!j( AB|A:{|TFYOH2],lKbJ87kKY׌=2>^Tt A]8'U,^&Ѡ } M={!-/D%? ^ ψaFObbֲBZA© L9{΂j~Y׉& wYնڎ4Y%_p=+aNRn@% A軥ms*+X{zÅz(@dK H- ɁhczLD1D+:rC0[M"FZu+o#9^G/ f0mzu< ?q2we/uJvߗio_. o}Y}/VFY&RpA8miruq # {9yӴGIGK۔%qgp|, Qc ^b1$l_ ^x 4ć1%y@1?}| ؽ ր`Ή';1,:ճW!bjݿDX(S`SrfX6AIœx;O]@[.,B+AX9b+Vmݝ_!ft~%jӊ˲[}M.ז }8|)J0~ P\tuǫE([ :nM53VzA]cλ*[;Ԫ8#FQm/n,evM8d#q^.x}fpwyT/Jw_ WYe8Lx)_LObyTd7qΨ|©wt#6>"|L=@o"h>"\N;}D$E/ MVl6w"m>Kx86 v9gUdF w,)܈ ""\oUs?Kz1ݪݷsM>$V|Q4RM$/!JD`x-ď֯p""K,5?`lő/5~xEhP(I-#y"x8+EE@CAF3%mگ{CQt,*̖=MmƷ t$( WC_K(QU" p{d~?LC%H%zƗPıȨ+3ȯdH{(K3%N{t{ 4l@>N%Wv"@ɮ]aA♆<.$yԫDkpOq>r%ᑼۺԣ_k9PcF^2Ms10!ߥݔ|r=s߅jQ-XO0=g[| {(Z7:55zMγOXMs&]V$BP@I]Cn&pA@]G[9Q>[+ms~ä'y_82ocPߍ.ØZhK؋En/(C |wϟHV IJXxDi9%UbK5b VE{?2&&'wѾ|nJ/\(.ti۝D(cB72B0|>_W:PWhʻ~A v}[Ư:9-\B*}0QmUE꛷'I~+ kފ\}Ϙo]A}fcMӍ׸OX|x~ CMouh>|E}iCs ^T4uÉky]oE<]5 -u=Vk72O#ҍo+n{> ,fK gfwMU51 =Wϓ݈}hC)Ϭۄ)&gQ`"mhy=B{~˽+Å';$X8-̍J[4m[#(CJ&kv^aǕ z_TӺq.%p%Հ(bgMC }tgFWI ^^*)9o[>[C!&]yRy$6~ǰi7x;=n2+eB,ՎFVȅ9<~4T)YtoNLV2OF%o>2o%vxv\zP\oG;'&6IsgsVÜĆ綊)!h%"y[)YX%1{6s8=N|l3߱ܝpXwxs{5cydߩ?~wpQqߣyq{>>$Nkbߵ & 莋ת5r.{\ zQM߃7C{wz_Au"ВLtTJxHU?\W:âd Z=exM$m pX~vx?ߕ`O8^`N6>_HA.)e ꃋY249i6ߍߵGhšGˠ_Gm_7'U]Tq%# N>Hۡ<·GtHo=Nv >T"l8]Z^j|`n+78;~&{_GF-yD^1ikxsm[S-*pʏz&B޾EInϡ&4~1-^i/g"h-U9xUJ0OƭfV 4NFMû5{o2Yѻb7Uu5H[Zct8֟u v~ 3~׫{giֶ7ʋ^'~ax]9_<]VP a/GU_'Nx7bs|{:.z>*峨QdWW y!x&ĝjwv_"LJ{⟈[8@9:uL7{_g-.5DY4o~낵ulޏo@?/e3Qh43l:BriZ-4ߞOKvȷѴX)mL *Ϲ鄙oH9}۵ HMyY| ӏmomqP^8vU|~fD0"i~3u7=zFIY.8>PYnT(O:?5m[m1-ohS4襡B7v\gď7I6YG'[x% muO<h4F~Z$ĪzcMރK&,nGkb[V@:[H pݜ&DqbbtF4Rrho(N+y +dL6:\6{*x<o0!bWB*anSk;e ۿ,!1ޭD꠿8PSȠZ>7Vk;1bo ~J8o|1,A[ґ)0IvS&ThJf7bY>2~#@Qw }._Pz ebÚ$?|FkC{EV7M.H-셳o')1EۛۍLyq[GWiL{NIoU# L8~hRO T) :?v=O\SV|ʭRrj\O ld=~U3EǼ%81xC*{S=x{ϥS|' r_7+1^!ZZV÷źaIM J)-ZJqf?bwiv5}kAKϗ ʐ% !8*: Fsnj8W+0)A~M,SMA<> |(1%$A97$2}'%μ Cx2 vS{5o#q$;lŚ !m\*y^x)t z vHnwJ_[y| qM`l/MɦB!qjG/[vD\nx|_շvčim0⸱@inON}xkK^ǫ^0!./j~?ugי r>";dE L}{Gr5#@M%!=U>׶fb` yK]~mVXxSAE; H@?#Oa[[KuɨEr%Mg;B셇8X=pkb%r~yGv/0HoJߙ﫚0֘Gb1cwN[vn*E1OÈ|GU<`Ye+}lskTe}=EԀ<\GAAm$fXm&gB?,z2(!e["tr /%*~cbq;U+/Wa?Gq4q+e+{~Lng-T>pIE.y޻(Ь"505|J?q*ht≵ T?ܟewT"?1$_zهtwyĔ&LQj?U;#DGC(V'3$wYͱ(>$c'v^d19-bVѪ:{"3Ü"ezx9cvM|Q$[%ʺZC®^+{b[v'vNW֜ډ߰ ُUAJ2QRN=qxwڭ -eب6n?o q1ّrlm4D:qQGCɛ3wcq}ġ&Mg()u<2xuoqՌJ2=]V%4(a [0MvيnӮ(V1bU c4"b v8ub^Zaq3nˇ$&&ܝ ܟ!QCv|Z1:&MRMDKU:&?D建oz[HΗ*7NZ@4)s`m`K"M# V' nssH;q%zK;Z6-_Ӥ b^뷫k9A2*+yO:7GNv| IqD5m%xzOg NV)g߇!s85NRJA)ӪYjgϰ<0i ӵ6|_P2N8Y6kH)ꕨ %U-5W<|@21q8CBaBU=OAއi[b~D94 '_2KHKYT 9' @:NPދL*ʭm2_ݙ)Du8VygEH<ˡ+_S;Ϗ75v]dsHdB-Ӗ( q[%9t_q_熼R,T|A2 )"r{G`vlFzǡ}П˿M"s`.?՝(+3`QnH7g|D Iʪ3xO0?#gT絯NCqx%Kc.c'|c\R?EwiEKܟ&~rw5L9tPM  چ'o0XЏfF"rR>&N *`牔ZOUIi~2iZgֹkSmzi]`_&;< Ɨ_U:]uiyO]|s<빙`mnp_uEsK8>G4Hr9>=t5h$w*7sv̭]V gg$l\?;wQ#h}[;3~߯Q=2,*\>3#Ґ-S~aWiک˛4 hśE+^-V+Oivxs')w_>M(+.7dӍ|xۋ:,Im2h43$ wŁkqif+Sv_yGL:_LI>2LT_?/ccG'ֵQxZ/v_s])$y_r/L4w5vcn s =^iUhiqP@MA~\Q@j|[N@b/AB8Gj"_a#vN!M-ܳg9ԆLZTd%ڄ2M|-wKM3aXLZ8TFoa ]g̯aZ p70g> ?PD+& Zƾ-P;+Mqj-ўׂ4;b|[LI)K{3}^Xz畾+GNLư)9o WD;1J&AIV9~jj-ف/L,9O:z/ C.b&j6U xlgt|/vHnXfXDꡏOJЅ(}|u<ǭ9j.i!qYcx),(5KT?z2BY_d~e?J tmj.oλ{QlX3ǃqS3~䆼TbRTq}{<#;鎉Ѓ!곤JlWdmaDytݼE>4w9m9.c0qr,3Qg[ǩ6i4)xI!f(c鹂'}u9`O~K-yl2߾l/.r8&M(c BDiRkS䵿vr%Ym#HP'.=>x '8{} yw`ێi<G`D=ʺXHjq^ﹽ8 J_ƀ,o=_{ˍ<>?Y°ܑT{cJOq;'-CTmZQ >u8{m>ƷY>¨o`QWCn?i;X8[}Zc,~֧/q]I:2>>p_9wiN$x-l/G wׅK`WI_8OY &ko \:TBd$2]|k,x5PD`_Ne03,kMZYg^m;rb` *S2!뀳3ƌ<=5LH0|mq+>|`,1ʞd]}[RY5Uێn]86k7~Ÿ¶S$X 3Pb'WOUF]E6JgvՌ-W@YslߦxbQ2:'Oq gm]6giz`bV4 !8rkSسSN]+M)ֿ'|yb'$B嘠 JWuK/ J<52{ZS~:`eͭ(,?8msI6e ֿaDGD{4"w=hԡ VA:QmŘt JH˭H]-k}|{s+=s^hrk |q!Yμ4wW"og-&. ?ت=g0~G&嵌KI;qkNes0t0i^Gb(^8kũ9&W_a\k:õXZ~?ϓ<%W6+/c5G y0v~-!sk1JW9f >{ =eJ]$f [|'ѼDqzNF{7JEnUv7AqTg,vTXVBAi FF<zpr~_̂%;-WO𨔻+ȋj'=]Leem[ O)`'LU-<Ϋ3zskZ {;~ <1üʻP.w_W:[F@ m6^oBf(Rd{oY׉PN <0|?W"'c`>qD?JP ZQC+Ti͵*;aD Jo U-t󇼿`nۙZVK1^Ć~9? 8j[4gUgu353^_iNDlG" |qMe:~0Jʼpd<ي{5)Q~"L޿h:ZJ6isR[B {o4QcMaaWQ((ߥqKMV]`̎fWT3=`7c~K1+_hUileZ4H?q<<?{t{}~ u[HeJ⃳9nO&=0y:!盛4u|+6 FZm뺼7*q*fdЃf< &uCK4 /YuEzכ?LF~k-lYH>0^mO%w|k c0 }xN@j7F]i2EJ5nnq l.u<9.<'m$v kWM ޯpŽqV9RvMxjEsbbփH2[+$ZυHt~/6Ѽ֛^ gwOLw9sP4}Y?gt.k˾odWP]e*uy4`S #ko.2Uh,TJV|wqZ0햡$3# [Ş%} azzZ ݂3#]Mu"S"I{;~)[~aG{"QkP+*)e Xގw&:s(Ԋ?Q#}dk\wL;:mi `<h إ6J Zy/)Uyaq~~ÑEk P?y:|7;}晈L.R;)ۨV0'2T}`^F2/'iFo$sYc*^V3뗉eۼI6(*wƚ/*gO] β-r# 3w"eϐqGIjKHT8h{t?kq*(<U:O*,տ-XCUjhJd|c `rhT#T {0.c[/rs^+uͤ=s,!;._lEXI"}`w*e~W_6 ?s.IGE܄&r/,>g1 ǫB69P:~28Q \kltnգcXk&r#﹩Q!y,a`W!}DaqG bڛHXof3HKk>VrI@U1(9u?\B&s@clu| .!"د5Ss>D/2%G% bFwrg Yjocz~oҒsk2?ԲdUr {8-}t`wX~rCꩡ(L2anƗ=MÁ-!zx1.Swm [VQdyXwWmqɚE;VT24{T\]2ܢ!]ؗ; }N2n|/>+n ^W>8n}$V_g\kr}EhT'"qU#8 &1v0/N]^=/ļݶqQeC(J? Xny(f⺳H~F& &)Px$2ό>ރxHojq<=^· #`hO6)}^~R6"0nrW[s(UR":ZF ŕn#Yc2b-TUZveďM*2}d.#H$Rltϩ.l+*!o2uإ`GgӺYp4v۩=Dmy ~~ RD^|?HSDg3E8+ů E9<>E&1G'8km(s_֝-rmn] (!T _h .?O%x_ޖuG/3n9 ?w#1{]Jbp*vuN{Nr'|N,_OBq;{lZ<.yR|1_bYړSe^.1Jߓ?w-+J'bGS۪{T-.b,}kě}_LTu5W +ufcO\{Oo>#Ȕu[]7KӒ3~PA+ęV˸ݵ HA92Aɾ\ƉbǥG||77i8*3Oϕez@,EӔ6xj݋t{t+P8k)6ϓGr+>z~9͵ ^GU5 ~7zF{jFzTjG! $iO•?M?kH+&UP8'Tؔ/ DX88%XX^&zw‰~.Hb0}x1RRX&蒹}=D]`T@@~$wU _HGcSS U-yAAI<6隞'UۥJ٥@mY5B>O1M~.ö eՏdVܦvc#[_븘q #.5sN z,{_881 ?U~qy{'yt OVj#$ꧨccWJэ^#AKA H?X {ΟQbzy'.'i4Ggs>KD&|oNjl5Ff{6s0q/H{+[KmLCCeP|KrrҥQd 'C79HHwq!h*- XrX rOv⇽/:4J u `1<? !:? 8YxLz^am잧thfl2t#:JoHWMcGB <{<_.?,t9^!=~z>|ߞВ=w)"=b6^rJ$.*N9oD&Q K8d,^)YOg7x=tOS/|&;kpbt`~ޘoKU| RS Ƈ91s}$ r4xLkX{v}sFg74N][wKQ%8Zg\KU=VYfP˛gVpCny!iF / 4 (,vMB0$)u=Aik *i죔4y(u7#w|؏޳HSNy G|isT Cn[~7?V*uyبl͏~q`{!}p׶*͕TSO37𓤰/;mFy_xك{S߫3PN#s?S$dmY5+pErCOG`q>!޴A<(ůż ~L!\K Fq~c,-._(?4t6.͞q$ yZybd^ƇT{'r,k"A(˿oD~2ODy2d'/Xu ,?u`Z鸷[!J:䑗P_UC/{L+ideцN\HHD5N0+MB;͇UP% ]I@INy/SeBg~^cTu/Nlj&gII'F3[ ZdP % c|1U^ē 5ʘ>}_?mEn%GFT{@cPZk u q?Oa'*_z*YjJ%^ӝNȠGhP|3ޥ~[:0BE=Ap|x_Շ*JCNAym]Jm1 U[hbWğ?۔HrN!mGD7⎾}`*Dz_?"ao4Cu{,xc2WSbe%'ɑxwxͅ |U`?`BO$Z@ ab@I.;y՘CtC n!UAR.7GBVnDh<8YY83{kq$8yއbto~ Now9U 'Zi;9N*k/q Oq9P(A,%JM"ݶ@4Kι%cUʋbZ"T*XFA pQWBj;snLa4C%q[쿯x$} 냟 yJbyM'Thi; ,IRf :sX䞺yb܇d ϻK =h_[TWSw< eBހY B Q-@$mI,p=0+ح>80^L^îI$ʣ5=yLvo3Z ?R@#N3CN#"%҄J/ )3æc?̀.:tS+5cpߩ<(ѷK\s5j/r_ bʒVhfo\[ג {v A-z]gwb.qx*8 |3R_N=e1< <3<7&D{{'GMymY5mU/<7u h WۥQ<⹤1*eW]dw=Mt:=(ԻȫMP# p~hB}Hӻ~_/oP#w=KA=cv6NSqpQM-ƺoޟpb(28U)Y-q^616 ޯ@O+SP8AeWP*~J ӍhXk?l->9uӠLQm;GcS yAm)O\j^{5.,c E{a@S'y(?Wuf< RKlC>s*DV[Ǥ6$IE"ob/^t!)9;&‡;\̳p7^J2-iL=* naLiCd9-q\7::o0V~Fٜ^6 Ʌ;oNKQ%l\#e-PKciΓV'_4OѠ%Ų^BGS#SI] u21Kj&1ogk6s?ZsGAE+_2Wdf_uRO߹8?04"4hGbUW@ KO2.=,ybA%AU{(Gv[Y:J2;}:Vm'Q3X/Vh۾`#x0ϓe<*ww8)0>ģt"!v`7Q4!),~4,bzp4}[SOR> 3>g-Q f`́=}⣶ۼCWϴ6j:zQ*K++m 2&_7/_ޚ * Џ{+ͥjV;rv)^$KquJ&4ҎdnHj-lpG"ׄ*ߙuqbڋn3~ur7K1ϟHr~ǃĈݧdž0}(:)ᓴma uhmS1]\Ҷ%^払Ȝ-j[<~m܉7F~'0]oNK^oQ= LDw*)g nXh~aѶчcNv\+~7h޾ŴRv<]ul~yθGw/8r;`";ӹXC( %?$9C;I,t|sJ V䦹&YY=rZֹ|p7ՄDEh<[8>~:8_ʻmq7.`11Zh|eJݸg1RCEBRnRyN(KIҩtIoXՌH^Ԧ6=(x ;-_S@ӛb ܻk5+yŝ* `}Ȫր;`+Ff|iZ<_Upq~ GE{ |HcWU^~;azY3!lzְ_~Bou5Kb!Kp!3)H*E\9>#v7:NY'y+/uucWޫ!7ǼVI Ƴ^/#p:S qֈK`MS˒>~D R%ͶQ=vÈ;s+UMx0ͬߧWuɧ;2طsyUBQp@df<[Lo3%nSa6̜Gbc:,oi_?TD&w`CQR'V?Z75WڈCM\2.6ХzZSxdԏb*5e Ciq2aNx6#gߕz '̐/s꠺bj9\4_mOua] ʶD 3: ߏ<.#VD ⿮|@rYN%Νa \W}.' Bσ_깡ir͂ C:I3"}kd }ΫSFUeU޻יi`CPgwK]?WmV*snynzFɁ^pr}qȳ̤{aI1׫)y;?0zNqST%_[5'+p4E](.\rf+( ܖG>~76/4`dQ=#e܃JGoqK o҈^8o/Ǟ`%sU,^Z/PedcjmuPA:6qݺH\u@8*k!a}O7QEw12nI nG 0?)!/_.pl9- +Y~ bR…[s(DLg̃cZt(pKv_p/?dϲ7br3DAIu)\Ăi/J; `*Ϯq0fЇ`>ґ [k%Dfe2|璾p&QUT7I 8|Bp?{")@[gQJ>(3mu`7o3zsHwަV=/ |ÄmȠoЧЖPG0_<7[+uqް.0ƨMmٽꚂ޴" QOOF8Lhw̆թɇ=vb'^){75VM>Xr~5 J7Oy@F헷EdCu 䊟2 Z4uSZ T\g̥Sw&`\tۿb']|lC.q؃a-H)b O| LkvfSx})Te͛& I ^, A v:РPY+M?qٜ~gY+Sߵ*˩Y0'Zכ=}fz ΙTU¢&Ǫo ;H[KÖ˘*tQ[6oPIXp# nxxa#TCkWb;_>U_#s8疦 u3Cj?S"4Ω4zH}l"5lZx٩٥ ^Q+Iꇿ'нr_'?|roW -:sso?Qe?%wѥxXľ,2瞑~'_l `C;l:DxqقZmG갫k.ߤYs?or$yAGy(=;/N4_L e5ywMm˯fŔS~?>7:8#˃ty,Gno7Qna>||iGN;EdO377+/|r Q0 8q?E_!-ß4dbh~8X.HǫWܠw;wcAyNs}acg癘8ayzgMW.?T\zIzK:*GjLJE<1|*b/<㚑|ғ~HmPN*0$s+R)Чv6mSA>Cf::xf`UdDUDo&yDit˄P6ҝW&2d~ȳ Hl (b7Uh-[Y9aϥz?d}d{ UrkBw([Bx΀=%zE)=?)Uבz;7.æ]t~&K8T[׏p|)'*'"@UZ_ %y 1`سŢ&t;^)ZD(s.%0=IQR}|FpDf|~*W1[ȔzSό{d R^vh7ϑ4%V7ǸXD hӟwBnsZX빪 @{m|U",l G8d΋hhwExImQ9`N{Agp†0>nWJST}x<.Q}߯*H__K{t Y(Ů/tSc%=޳ݧt"6/q0y ڿRT5= B"bEy C2͸a<8~Mx\ ouzb)2;d|s*2V]v3ͮ*4G~X?l#j';He}~*uК'pT6&sċlׂaF(MB̐2-WJ() 4ěO@nG1kCUHbUS7T1߭{p/3fbr i??$TT[hP*i ?\U'gčZ$ 6M@*J6لsA<.,J g|@b 6"\2f)*:x f |GFlzyl'BZ[j_iim7I vk:6< u ~,XYi~[ ? }g' ¸ɋE"JBߋ(kP!8xYYAUFh1f{7]3SZq̩HXwIOA{>LJaؚy#xH>.]Th0}0#v<*Kz\ykݛMNWEÑJaOKw.<ƴX߹?n99X=ߤ<*yQ73{ Ը3Sgx}7=3i{)O}?:7{_75g]XAUeɕ_V\נ'5魭}u|ԗ>+%b}Mh.'~WwϞK]Jނf+a۷Ϸ?去߼ffͺ]HdKx]m!^%?B 1K8WWGjtW$CDs%%>OHٱxdMO%THs?G/sW۹ckyv%2(kױjU$΋^ҍs]q_7sBCwY7s]P)j莗"JZ'(6W;|F폂$/c5ϕgEZy~6ǣPYK}dfff&AIYZF[`Z $aMP䏖¯f7/'ǿrݗ./)^gݽ|%4m?cWHUcN%M&X cCe{O8b1l$vraw}<Azoq}Ưp&k ﰝ0c u"Ae49S}w#Hsq>ٓg~ۉ>~d&ƒPK%(?#z`"P'LfpeGyATNl/:2 +asEyHĂS$3٣|WN.`4>Eߎ%2/H{[謱DьQǙ̯x j#ڬ~0ac-=TtP!47eH;91k/-<ҏ?cv+흾b-=6CƢqImLoB|n^;.[%/i|#5!3qB[/UU] yO;(k ӝ{웸)n@<ϘLJu.3vFj'TGo㻨&$0"ҀYHSY=3la '"O< 'swس7s%8d|ƻcD;3jI#.U&$Hcw~k,hMYnGn0TSw3;]L`DuZ>kZ5hS\S$ޠ"ǼC&j*x p,1\-1j̘ήa7Rn]y H6I+JA#CL̇>dG.3F|9_!n^e:+5ǿ\(ih?Mww7d_8Yi$dǟ_8 4!ىOf h#s{?7.!.;OGIv*^5zq&MOQ:=WLj&)w.EMZLRc*۩8cb>|p~4^/<4ם MSؼ<1e^R*zxO䭂ߦ|QusỦ$UyN=j$ak?u(7Hom cFp4^`/U01Y.KBWw't`<RbY)X^sfDy%Ox.gc=~kiť?zZmc'zJ >W:OsL_W8sIFiXDeԲkg|%YEEgm;-XMa:8t]h_Qr\7 C_}36翶] y>8 B%ʒ?aOc v#8_+^z*P`Jv5qh|ؚXS=wCtBԵ =tΛ|I54"re$*eS\PywBz*g73^a\nb\sq]j…{SP Qx1J2KjW Su~x򞾶NmH;>wAQjLO7Sc{X_ԈAi×n|7xyR7:4^u;~JZtYd(fxY@oim#~k1){m|FCX IM\Kvtz*eF?̋ʒQk2b$`}q}gE3eyȿ]^ ]XH|kq@ qZGDflS\ډs4 P_o[4Hpf_[7vk!zD =[~Ĭǝ•cϮxοq bCwoe_[1xDD.zĝhV#gyKf&Xhj5A!lxڪ#?Um7{ G * Gpw;K>?铘N0SaXO{Z8n^-f9ܪ^}m.Fǀy;R_^CƤS$ly5a߯˝NS j$È e {WDdPr<7E{ަT^+œ{~>!i疟%Lw!}$+3q?3,K҇ {|}{HŁ2^gw8ƿ=UNSYuPx3]k^I[0)@MbJAWӫٟNbE61gGkds=ƻO&=a-.ПqiltmHqUVZ| n?z/k"=8Vוvߖγ|+AFUqC[t([" j r>3Uzy|*o1?O|+)41oA?X mjJZl1¼ƅʕ U<S!3k*!ڪ{cKq{PcT,`2]MeB.JubBzI|`/҄ޝbmXiӯҨHp'C85\ XC֣^j)r; /!qۼwI;3Z|ⓞϳn(~_&ZNi1Yi&Gٟ*?&y76⽽,wB ?yJjjWM{e[ڎ_ I:lVuD_&>P#6ݘn](=_k3~7>x\?{, ⎰|ۖ댥ۈX~iP g2<ċ_u();L#$ks8BncLxɘ7Ne !{ۅ/*`o ӸMg>uet'`#.F]ZV7{7N: GS鷘۝mlDZ\o9Q!Z EY~LhH.z٤yi_ t9~2A[Dv^Ϛ VԐ`3xϺx⇏w_9OSnot q0l!dVF#V/2z{qi KQ=Ɯˠ> o0 ڶ΃@[jbzyV&,i='a"$tMdTD.>zIQ _f|q,ٵo"SX"꟬?ZE%EԍU<.e(y-Al^yʯA8VWlX U*@ N$Oe$QG;(S)JMP @uszCHam٬"Z6^B_oGNirފv4Uo*G:*nՌ" ~UZPغ^PȮ+'YtICaAYag`y,YB< cO<Uu-IrVb| Pc%˼pMItQnqo,45łD3M쿄~/q%Nm Sӕ$l]_0UuUm!u 3[:Oޯ̷\O}O ٱGdy\"G7|n#XfM:0k*‰G $/+V{?&Ē&`J%j"fy9n,I`)iJhT3>rp4jHô=:mt)&(܌T̟(KAp0Bt=.4Q?V*K;u/jU󋯙M]yH{2<7d}sn?U鳵:n Yh\07=.x? P:jQ/c[r,+?z/y{REgKkUk}g-8([R98K'ئ$^8^=-ǰUcFX#^VwV`j,Y02canZ}mETs$^d̆΋ %jw)8wt|_}=QgZ, xZ=ؐ*d?,A9q ? +T1x#5 )K#_NdP1Nޕ:q甗z}_R+NxbG]33m"$#&-Ċ͌@5rO5PJbqG.G:4N|Y*^oO.">.LKJT<<>747໫OPa^>c=w+8{3[Tbϥa9}su/剸~'Z|qg>[-7L?.S9j1" FYUnlU>_Lsgo ˿l۹n6}qb? \//@ Ip}87ۥl+~#-œ'uZjv@pAx%WDu?W'8.-TM=wB݄kC|88-ϙ8$̀=52 *z0v0i| Z5+.vTvyy?cPO'Qzhŋ,HZei1p8ՉDmGS4wX~/!˜'u%~ PMk}*_'Tv^KM>n7xq9V漹ζ CgW ~W74n#(a:H[qo^2bnBJ8a<H\N:J؊iZQ]Ұ~V*yO.\{۔Jp}$ Ox-ˬwCPEt(sB 8xUޤ<Mߣ:MaZJ[(aM!}9,}N9Fܟڟ|:#wʏ sƇ9H^ _y(5WEuWK:"yLԧWT[+?IN$g={Z_gb qjB~`:SEuPޟ%/E@~'fcWf^Y0^fNkٮz7lSgB`qZZyT!nqT}縿 nJ=:`dDTq6̅?cdWߧ;\i&L'kAfaRPPp߷"@L-?R=LئTi'irYi-~#*emgN Za6 _93ÔD (@̾t~- <ArvBo;bu˸,'ʫ[y)-Ţb >'pq샦Ndj[5}^O{;_`|D'4E{ &]);4e9>o~N-ˊB ^1?jvWq|DriQ%aYۃ;&dZ@~[1K_ /V|F&S0vO9|cwڎELZ3 \`O8 UrHP(UpyXPK7KQg;;` {>mB3?"e GVjN9.E]ιwV!avJx}YP \gpqhϥnLXeJ|ut،?nm?UKqk-Kp.MA}Msmk\w w%A;cǩ; t9lIr{m=#_=֐=5ob }V4:迖w`t=]|wHKm5?Vqh"-&xY0ajo1zHb04GbU~d!Crѵr\V^N1%/aE;y$= k:Y@Ͳં|Ӳ~ ۺyD!';1OO=ו;nJ~8 ;o"y(d73^//9L][uM3Os y3nǭC6 agmW*I qZcbW=My} 4 \KqO;^b֙_q%3qsW`0^T墜Bllk:Uǚ`GOkvYЅ~Q>Cв?qA~?_@nЊd0 y ė  (6.&<8{;ͤPRA}J(V˗!+1-}">`qovՀKl>Uk_B|eסzϴP D3n8;<c NY=eN"w| &Mw-{ZR8T3}$VIGr-R^:Px-^f jH:ZQAz\K2ḢYc~<J|Lz 6늟;/)-{{Z@~ElKZJͥ ,c% 5T9O۾DJc[8t"ofM&  f0j%0f#M#HvT &ǽWÕwۿx?h %pl+JU/cO(;0=Z}tK[x.OΎ#xpnu1A` b|0qo^:Wl!j-> NTc/jrJ4O#{)ƿ`;|7'#>߇TG]18Ie=;#jz#sGX7W:ߕ"ؕY~,NIa6 K[?-U6{xȡUs/!ǻݯ9H(]NCʖΏk|p~7 n_Eߩ`r[,d<)E{*7F^i^/8|oz"`!1&"|+}\*eD^mWEzT؟.>/K'>kX20弆8X};KտƵ_-jgja*׭=Z^НNl>E v1وw{SmB-s_m?K4]{~ʿ7糥m8ߏ]ţ^)ϒ".~DVB =wtFDn~g-x&4]/s-h[s4FA^L@6*+}zӡUr`;V;~7aaOǰEow|>vP ,mؿ_AM{2y-Sq#$_ z W5L(ng! 5~= lVezU nG3 Fd#tF/Gg=QH1ؗ>?xi:J2c}X۪6N)gYFndgVqO!oY0Ǥ瞔J{{EVeXaf^g\Euxϫpg*WϮ?9?u_E|/l}3~4A3C,4wk+<޼OyDW~qҟux[YRf:L[VM&G#Vd\ n#/jpn|H@KqI$>Uu;/\:wDiZGo6E3qcS) ZcuO^~e:_ξ%LAufr"b?J|^;IOqRfp^a !ž|"*ai ҈ȳsU1ȥ3;֋k/ߨy]bLTїHRhp}-`J><6~fܨ]߱ZmP)[YIG/5Պ^Q!G=/%Ngd |9)37&sL _b|ɠq\Җ7+ *s"MOҩ} 5׵q~\whA+ҪwqNa84ӿ[IrǝP4o k] ĖoSEDlp'ǒ^{ުw+k,7f/m,ԯ72%cҎbl%nڴ-Ve?T;QҜo;UO) Q3 Z5E(^ٯ{ 4u79ǠP^/-ƭL<̡U݂ݶeDCocv6#Qֹa*#xJX|H VlǁypwQ#fI-M]`bɂ 8~՜R*8v# \&]yo,4kq瘝C6U M 3ˣuo-y~#"n<ߧ?`Mع \?Ͷ!^ ϏlR7\ɹdFawk12P{՟9mnVlQ_a&4KpL"<%68$o1vjZ=k"G`A!&8y9DoPش%4eX? ǷWEbVE:?u" 3@b3aAs9}\<< u(e1֒8D%<^*7` º~ 81Up';QCZ{y/qUqx801K)ҸjiÛ3,"1·}K2Iy+Ti N[6χ6#n_\"Dߙx{wy5 z0` =ycoH/z//M讣4?~Sw>QG_=8Jx $ϝȸ6#}#x V:+|S2Z-M9=p:ws@3fr` HE>4/UX}+~F?ħ"ВYgHT'0"F-|W-[0oHJa="~'ᮄ`a] jr4.%*A.Ϯ徖8D?7DL[\9Jv71Hs0ia[^1hy}z=X߶Kإۉ76>9m+Vt v!W85eTVϷL€HNwq~/cuXe@xKr'\'({1~:s?d- ^q^:ίgʝX|8ry3`ȇK8wU:7Uy?ռuQhZdNO٨·[ c՗'$%uHZ[+ig|w>Et[R lExYv~g[i))ޔ xo 3ܭ! iqE{^ҡ[{OU_}n%w(evW̿Zv1?#xhoXxZ( :;{Rx2b%. TR=H%%;Tou5xk$R|v׽>]c_+vt_( &D=ɛ]%*Z7:J;I/Ex/߯1J+b= -zc͢&G},p7syłįQZ820Awq)s=).NLעKs_1ƊKi?*|b|YU.Nv¶'l3;v37ę9o|źo4HmQH}KJ9vkr"ܯ;pxŗ_ Ⲙ ac1C-#.cw3QGeí\dlW+LXyJ㰕(P-{O"Xdny7(Wh3xǝ 8U~"p~j3KviRD9o1 _4 SaEr3{OvMޏeLGc]Ho{-ӬwAk.T&wÛZxHd`]p!?!drҸ/Lbl:d5{KkģPN:.q@,K׉|ƌ 3vuVOݩJΗHƏ:oϨt-0?Wy%} C\85񀼩{=Jʳ^cޙB]@DJe=["s3m2HuRq /7b{^9l[)b~_v+9V3C zQ׫72U53)}>j|Ib/o Eu`7ogk5D%^u<)xkOgo'z cs/^n>;OkZcV'Jꙻbvb2@p״H肟.^+?fy[Mj1.䀹^luF٥}q< &ۃ J?yx~%f5|%jy1(ȼE!`w#i1͵gR~-Mx S`'ނ yRDrKr7N4&}y}[8u.OwUadt)OJX~>\CKWb=^Z{K%P{H@Jo1<%R]͍[͡|ح! K$v8K%}'v"_v02d&vj}Kl!aH? ;7SbZ;(iZ<h'.|]Ye.Z/*uBfʼnXdȗ&\:|7_F`… 4GgZYU2;Uw~} ~Eku( e\Wr/|T\Y|ﾎ:zP2FPD; ;wQ$+R;OqSԨx-5LlO.'F*aQxKz{ >l#/mRӿ^V}dycT}1>lB-]5 D 4M~BL;D MP|>}hd?BKi*q>{1O! \˧J x9ߵָ%꽾 J>78W^KZW?Ӻ>ˍj~D_}ǭVO}x\G{%z8hM|sq?xǿu:c6:(1F~o bQJSicҾɖ.tJP mnq.6>J)qFV߯ĉ(5.}x-$Ȳrws1OѤQѤ1E}M9sסd\kTciB%-n0je`os+e+ 9V"{'G;N\}} ĝ7;MfƝvٚg^n~q$?bG%Ͷ<8Rɓkt3N^='|z r`2 ;gPK=I_ U_Y^tƭΛYX%Q6+(GhXA!O!HH-x`y`Ѿ[\9:OTwqZpp=x|_ Iη_@M =ۡVzwԘ۫E,fx$ ݜ7| 5Z4Kx2^{Mr;O d(&kVNo:=x~4H{EP<vgA>漾<~8uk]w@SJ/U+!7{yY-Ӡ"-?h}>&a_;XBi1g%Ɏ>&~|.|"MjTQ.iY]Fp"m*l'!`Fc !|9 1&'\ M0ǺnGHI [\a}uľ[BQoo#N(HA,c0F_z đKeɓJVuH9w H+wES߷^nG#)c;&[i+DK"vPs:EtŶy#/4q 6bO*R+އ폀d0nm.RE9q m8w+/˗ v C;ϠW>uG>$^\Yf~DٕkYshKH'B{%o8vOoG%xg/"uGX&:o[N*WEǟCXtm~z5J950qPy % e}i* dyIdh]~V㥒3z򋳓ȳZQs_7+T\k8Y(K)uUv*!^ZnUP'O $6쫐>MPe'h3_[s-*@%aHGKhعHlٕ%q< ۧin $@䯄G RW}K%~xuVی+/qorFV=;K*ޣ ?319b<+_q-~{`Zea{I$4#`a[]X0u:eOgoaa\Щk-헂4%mv]]WLY ]afb\]ԇam1ƭ ʾK0O%_rFvF5Kb/ #$@,J.C2ª¸!Ṕg0~60r4SCn_Aم**a~%0`#sP O:Ud  u!:^vQ&%e}3G8ތߋLߕdp9H.=qFJÍĀ(_uDAĜV+htg_q-o-yZ 1j<`i^K^U |ybd[O -  OQ ˮqOr/<4b+&iw_FI{oRySL"eQ?ϯ^af*7|p5gͦ|ΑA>qU.b7Y=2EܖL*KNⓎ>j bPpp=X7 &1׹Œ[? 9i =6 _UlYQ~M?)$;rb4Aֺ݇z`5j}(_yN1[q95NU5J08#f-wm[ \T=fUWyӽآW7Y{x!aYڏA~*Mr_o̹2e2rWuY2! i>~`"gkBQEQ?R;K3˔ {;U;zԀpb'nG3y߿^\iA)=Aea'g+~m[Ư`3| Kpq} n j qH >nͦ/vY{}:@3qv4],WX^_Lqn<1e}_45翼4ҳ_j X͈ˮd( Lwx}&N?5${NGi"VQP)]9b{K$vЗ3 8q+-V*ʴ:7VL,K[~U#ml#*3n92-,&Qo.L^nt7nOR;qJǎ>1F޵Jaطq//"ٓwUݕNu#3O;F܏Q+x?wp3Us~Ӹ.3!s;~7%=O^M>Ũ\o]y7u)H\=KL\fRt(ؖ|5 T>J2?Nz΃طڌsc^}VlS-?T_Jx|҇n;(AoU}^p⍘"|9Go=ͶO6uxe}}*xF^<-0>vT|K˩sx\USV b mRޚ`¬*of\:Qī8؟ip\|G:eĖ2A.L$x}@Жq~gFjjW%[/-p<щe9o[~ª^kD|;\]_TA1 `׻riw;S+J}3*%>E(. [lW 9]h&DVɉLh`s9Nq J (0{_X %fL~B3;/8;Vi0'x\A<{8qN>~?i4ns~eA맹)M?<Ea1\}rp:q . ;MsV JZՋ\ DjG& > ? C+gPr<_瓐x)y^|c]iw0Vl+Zj9x库^TrS[IE%h" egcB5s6"BI[;mq~4OIyXs*+nY!=MIXͬ%Z ~2R: bOm59` KhHQٵ,q3bSSr݌-w>^s1mpl {9PlŮn:  v&;,M=.YQf?>^Ik~<"c9H3>rfZ'-~NSԯ wc~Dtʕ;cXp[pÜp"k{ϝ}V3繐TdL<)m1uS*ClJգonm[aP`_ 3W迶IJgC;QﱟOzz>vҋUHKUsE:*Gu ܫ%:īÏ_gM8x߂*"FO?$^ ?&|o?)$k~sӈioE̹| /Y?qؗ%eIc[L ni;q~_iRՐկ43=(X:-nLγ !nk-.ew0%3LX+F;_<'1QP)we{#rFYf2Seӕ8"#x';li4AӼaihcc6Kj4q~p;P"JrœN6 Hc] 7^ &>6 z6jfԑDf/iSC7DB%kF\Մ"-8y& DBI7׬ ACrsZ\P!.Nm18 zpsbJm;8U%j;T 5NCYye7n/d>%ow:*ypIRanyi>#Ct_qkǦ%i~N4xFA兹I[ /%q⟮N[",ϟ>>gmjd 9>wx;_̵֚({G#xΖ[p!ٚm_Ɖ4K%z9;!h6Q%*!͛Ba[$(G{6o?AHWHck{OE )7~Ke0$JG 4h&o~BX`xλI~'R-2QUz!o= wZWͣm%5I[RQ|#_ ݅_ӝPT%vNyKPּIaOH*y&qTmKӁW=h%̖YƏ-_xj#eU n9iywޞtKa'n7YbÿԖh7\!}m%nV)w?i3nUQ⨫ cϠw=O<_eGŢIxb?sj]ubcTq߿xט(k9&vwZ viulh?a7ٟ^DZ:(-QԌzo1ciIpϜzާٜ\b\S<-Jgܞxf$'=>2pt$'X&b2jLb'K;- O@m{9˃Z`s>\yϐL|pRt4㺖]Sn.brb>ܠʄ?AEEU X`ٱ .E9~3[⥌%#`[6I%-9]s_Ar~62N0s4HzI0 ~V LدdT׾JU4*I񉦦Ǜv8XmW5 1äa+Y|s>S_s?]sO9Nybt; l D)yܴ\+{Nk9qHEn%,g~KyH1k-:ȴ |5Uq.^~nsW OtTQ?y.AL.>ԥd\926dg6~5ɐ}V~Npkz=8,[po13u5@(7rJ 5+o s޵k@sr#S\7߇]+UCfZ_a_>bzoVr1|\aUi>χ_~Tts%l8\ZC XM>x慂u};]8җ\W55H}u|';k|t_BQ <8HJCzn&d'b4&a3aKyʳlJy\p L;-+D¾깽?JqMr,e*{;{C22q{x`yP޶;r6 W0-==2 ppNI?r9>Q%S`ܡݾe?c`WN ]`:0Oq*^WevdDWYe4ݍo']{P}h2LYq﫹'k(!YE~ӿH8g鿄dXfe}Q9hgGzWyzYPA0Z8Uȟ-DH+2wgkkh@mq QWqmN$S ~xvdt~/hc0^'7MvZdp4RCXWx>2}pn*2L$D2%M$4եJb\b 4_+:m#8c; nljAvJ܋MuZ`Nj`vchԞt8h\oveAR_qm}TX6y"CsCyuW6}؏؍ h2]mr`N͜ :|~ )\ KNlu=.7}W $5711rNZk7ɗ#w}̘xc`yJd!OoEMc2$R k_xO5Z[x/~ ik[%SR`6阜fMHfS٘bHe|i.JvU*>>d)^M֧PB)g,>km}}Zfgd#0͜?깿~:م5w v悖xywh'V;jH8x E7~yWk I#D;Ho]|n#߳?vۯč/hqzW 35J@P*cTs7o{K|USUxy}F"v>Px?c)v+kngO"KJ 9~2㫢~ q-#xFj'˝kdsՖT۵Ǝ ;ќm#){yإ+|kȢӗ737FZ||1TBzq$O0W ߙK`0_$q`#jB#^aZ?w&"Hj6D+qs8*Pe>(]u0E$!݇+BˠH't }4U(?5<wӻ,M%d4 YHip:fBìsoSW )Wy)\h֘1x\&Ԗ2կ: Gk/Oi- uB@s4s۔Ν G"QF@d[jTgu|w~I^hBT,_ yL(B5XU^߽?u I5α"]^]sӎnh5]N%3]Yp{R*=pd&`q=VZ'379&&?c>*ć\OҲNO]ٲdOM]wyb}ZEـVQ5|_W,cV`M'y_]/E'6WǻHJO7ħwwIA55s7iy}1kcv2M:Ͼ}dܫ.ʇfmr'׿e$d*-:Oi&jNs l~4Lq-聃 zKaF\I;LȚ>G^]>vp|נ*oUe>T֚Y$8mnt;N|A?շͷKpwЪ!_2jr `_$h'&q7pKئЙPR{dJ|\\nv> (jiX޻7_ 9$x+B0ܩ O( {ܩf;np#i-^틳$.(V-KŰBA'WY5ISJgިj4zJ$h}kQ(|Pc<+Bk3͌ ']B˓ײP˃؟w?-rCwYc|rۺg;a`lVЮLXOM6n$[~)`D>Pb7ttF-:{W({C]=< 5/t9r#QVC)1FpʨNg!F8T2GϜ$O< f:lq/4%QS`~ŹY`a%*6ro4u8',$#0n:UT3W{<ƯsxS0xWҔi9WOKd;65 )siWqo ή1k;É5y 6;e{g% _1y<:>w& } m#O,vD|j%X-GraOv<<1]>g?o S+ܛLjanXVv.Z|y:> ua:yW,:*/*]y4^K{``-hZ #nBg> ATgj8=aLL:`u{;KLg/J'х;0<(JWJv/)6 )2%ugi]4꺗]>{K9]`Czzx_I3;_ ( Q}M~ƸjKo /_^J6; '93l_<%#t,vRxκUu[QpJщ/PVn"5vka2IT+UbK>$"bocb纭b7$Ob]+,+Pf|OS( {׶fk7Wz+eW['(=1o*Ŏ'0^<|Gٛsž~z;]sބVB~)C(Pp@h^j$Xnbb J@_咮{ /BM G6F0%{Brh֏4A|# Q F7 B. 3Nb=Ga#RfUkay&u%Ff8,3TסX|rM:,N0&R-T~0-+t7HêP|/m= ǿ ]h}~?#:-5x42F3B/{G.e!;cH "m~i<"S!!}cnyވ~}[M}Dkq<ꛂF`ѺI٪p{IB.ql;T%mbcPmb f%#okH^0#+LhcQbxW0Ce<2RK?85fڟOA?9n RO{緙եS貪{NsF#灔& "Q}S#dqO1I4Vpd|!zr >r/Ldpߑ!`+D*sDtd7%g`Ό~^.aȄG_-wpEY>kaR5,& Zq$3NO;kơƱo~<ķKgⒽ-!keI5? j>iD|,uxM<$1ѫη&d[ٱ9j@VUܜ:P8d"?ɩ9kR&V&@~V;w 7ʂ̇%~A7@8`_o7jƍ^3JBb] 0R9IUPaMG5èRnY>PV:ɋ|}zm.:M:K>&Ξu9_OG^(t&nK'4RUDϦap JkPy/Dip_53-= b=~קn; yVaiN˻0?©Tp'#{Z v[]2%o2xK ]elGP*R7ހ,< 2QNE>c)O)5Xlє V1ؾ.MLi_>%|&GP[+jʔ0yג*p/zWռdpd ZPs#3SLz+Ӝ6 Ok(^ bH,͒R Yo5ލu۾[q8+h Sb{~^upZ(e-σ;>e2iiP/DA4l~`ht7x׭b-O'ln%N>o>4I"Lfg'&8mb2 +G%̟'[s&gܷ9UYUYT=/JcO|a},\HO e˸+H_%u} qD!Ig/X~^Q9s Rјfk=+x[=/!NwَZ{#$gQqw}'C~E@H:Nxϙ2m[;Yi@UAtAW<*8 s.I e\0?3<-Jc)U?Ļ_Dq7q^|PK tMK*Ip=q.<}3|Z r\1 '4HTnc)+<(ɩc>~o}g.9>|Q Џ.ׁC01=nOg?\4d>3@*(V3#aL&e/*PfX GI/jrCrh 7pIF/'~Ȭ˿*3ۖv<<͹ǟ:ޅw8N!V,zx[{u%{{Sz aH yGL<\w- C)-ֻ?M䒘%s Uzqm嫉m}4QO=ϯdGIpqws=<0V$IU6~ӳr_cj;0rn/KE I+gu&wΟKP ~ N/|Ȁ@ıAl~oj]OYΖ ]^4?=+:tŜ&zyvViyvy;tA\k/rYՕ3ǦEkp#@\8S_o(lrE'yҸ'g\6ġI#Xr,(1ixss,X'R!6?Ytǔ-0O%~7᣾fSsv|R=XR˗pʫ`K=~]L%0uT{{W5 ~u*& tZɽCӰ3f~<p,q,M? ųJʼNK Zj01`ٮ5e_:eWl*u^+iGqv;KFρUc98D# 4ILBui}pZ()lkmj1 nd3gz%,٘&1w<ܠL]ٻ-#9DEұ2gtR6^*S-?.;Ao)2^^D~OrTTDG&^=[XB]kFVrZ?wY#sKz~ g.TDnIvJfG!ղ`;=is=*B'wÞ_6+lѵe1XJ{I‚ʬ-l {h=fK$?_qeJv'-Ijp Ibz|b\U I»GÒ;'Pr畒#?nY”bu>0B#x^rS΃ 3_# ,{d½fG펓pZt@ۊC=pMVWfa:~?OSe=fy}TЉhz˸!n~d=7on}G3uVrmǢ-0:{u|la^"l_ˍ 2Zc^K0~_rE}W!],Mb_1.u5~VЩ}Ƒ6.Rmdޑx[dnɯ=[8rKݚzD~GFWPfwB]T9|xd;aW.)z-<ÿnﮪ7~H~dMnA;,yS0m+swBs ^SKo:)IK<yu08(FةO«,IE nT|O+% &`<z򏤭7%U>{?as0- %<~=N8!t|}*9+$Ǖ* #>MfkJ޲4KQ-է[.3S0v: ӌ^N<"JI6RG|4`M{K67rd'X:oŸ#MvqUwą[ac(3#p8_jj ޹ޢBA 0^,S!uC.UCBF˄2ΛJycXzk*k]Xx20o!mZq-&iC$],\GsSaեL eo3%;8ҏo(1 5_Q %ܨJCzaQ2Iy/&Hގ砞lu Ld! L{<^,V2.6KFG!fIܮB!`Xv^Kua)qmڕr 1H/XT%{4uPx= .vi=*V pP?u=?r]Q`uNILяnuU҆ GsmU .MR{Lz߈3Q6S8i9b"r>28oSf ߽ܿqs &xbKr>伕_#)t:__v:,WwxQi/wZsBDE/TЗ*JT딱YkF"n'qRv8!+J!v^ Ѣdxcbﵝ1pg']3ٞRHLy {qЖnƸtrUPMGGw~ NF'[?$}NX}H7_?QiثmE) *o`zum# Ư3zpVU/"u#:aǃւ.z+}y`vIgnkubE}vj1OʑS8s/#;B LU%/*K+/~~(\t'Pۖ32n6k; {q\鸁B ͲU_ߥ*8'> ey0-^?;V+JBy͉tsy+۪r7x誐]HPu/4YO=$)Ҥվ2 ȴݼ`uL^)*mpuܸT( Q9MZLw445KTEqn/}7a 5cU./ã7lCf{l7ǫPW 4y'ܔ ;}/&t8__:s.sOb ݮH%uڝɀo^p^P8E6^[A_Vy_ǡ=:L`{G(ڭ⟷d/jiWPQ# Ο`P)3,w~ё)(S12 ψ3DX,h5׋;m#[Nxsl+Pwׂ΃A١nj~DB b+wk`N[80oSRÌ4T"2=kIt"/J>5RF`2`Swlv k*)Cfjr}be8 iOz_gZ<:~!K봿ǭЈu_ok;&_Ƶ> ώ.9uWl=ӏ-&>2edt ˚r3l~{?GZdoH[kW{a,q r%-뉍m `# {FS'ef;}j F=qi5!*S[@|Def O?~ FLXtASR oT3wx OYLjA8H`-9l]2d=o#@;Yɋ6'Acz/[zK`?8I¯uZs[;N)%˜vt9)FCF\ۃvZ_9_7 SWpƥ .+<1Nb{{!&=_`Ο-[Dn?+4~ /3p (nvx$ヵXn$}"n;RxRmUm{UYt{WtRkuV{eىơ M8sI4;cJ;Z hP"o{C7кEzKEl^J<~(Lc5xʌJV2qPZO M8v;MdlԀ/{yg$ŭ0z0| Ob-HLtc/s)Xv XeLψyX||Hk?t~p``(eJ&Hs_*F=xa9>I2u9pXyaqK/9/a%JM. (T Q>#n؎5Or'JA~AUFJwc{hqDGb4噵nμKItAVb5_{Q-r#Zfű鸼Okb˸9y__ L uqfʥw|0zyCV迧8bs GwRCtҞ[I?^fhYŷAJfͱJ 2^moFmG{PjёgLC➼pi{b/1ߥtpWYc ]>]|;xi>c ۭ[թ[$Hw#fA#ٟ/2"7>$=52&2xʣ1719v{ܞ|+&HYKa@~ q-~M:M-%r*M@+TpF:$N {?!ƍKO jpe%>j {}^OJ=N|~NI3#]$nd;:).5OD8#3Hz&]f Λf@@@dVm{׿ Vg2n=YxcD"K.]Ϝ_̒PR2vg.C&pY3M\Vо:W%SO3D 2%m w1ƟauuȌs]sSq+6ob/T0(O)r4<FJ.yQ ܄l}z+}bW@QF_ CҞF $ؤ"}\;jvꁺo H0RkjDӖ0z=N+oAgHSScާ;> qh=Y}F`rW9>wൌ~z2Fq_%!#ns_E=S_OE/C GB:V6OG!KXB/ ²T  **J$`"s}jos܇Vyr'k#7M(ϸ^hd_p(~V]0AkMlOLq=#G5oo[7/Wκ\0f^lh`4N3cO w@N ):"*S\b;8 S=g^)kĪ2ώu.o8M [P=m %AK{j>ґB3:̯DO]8]?=--; '2QuE_E(;xcgyd zI1D .đm69I%`4oua|E-m/kk}b1Xe%sc u.tOL { F)O|!,〄As uyкpk70nfi(O5]]b(Vv &:o聍N$CShbCpoKbk }78bGVE߭XN#y 쇷标} >T'Bg}sSm*>v)GQo9+!W^M3 F&^=#pH[7,oX˝0V=?6jTӁC4tw,Q }Kk]yǑ}FQ<}XBdNIypTKf+\j{&1Gn IIB;_e,^~넷pILYБ!_}op,pqnћrжnCumVV#|[tڌ$?Ef՗gww!m Ϩ+og!</zAqgXfsr>54N]rg#SQGcS2]ܿ㍿RJދ}.۟^V[DܟS'Dq|_&q@P޲E%k11*x?f|9\H@>qna0ͅ j8 n e2-s*E'5%5 KBfȺgEHn ֏+Jٰ^Y86{$N6!j߀ hqj;14T:Jƒ@ԥhD8j=emo#Vsv}{bD~F Z-BhQc(PO5UN4-=p4VG:[CZ fs:|+btB=/_?Vч3~#T.[/D /5HO uv]FuՇ)稠_#pٻxחuqq`su{ yE$8\ĠL )uxDZط}0'yM%Y?+ۻ/A]|pJl.y8ho-J}>9[m~wBIHukN.,9jE s9ůɚ<;J) =s=e*X/I;c9wYkOogypvE'vE]x_{GAL2ڈ/O+~r>}O0uDxL+i{Zż/>{Оo k9lcGu3X̻0M-ז L`Ϸ\贐Yƭs2j#&omoC%淛#\?4gU[בp_Dțe>M0+ܿK(#&hH܆L|džPD֥pӕF{ڻ\kE;20qcu]dNu F(9kp=Y7=X' Ӭ0qiFyQ>\Z_VRqԕHm.}LKXQ??2NX}yk~2uY 6qр9yJx&`&=fn";yǜݿh~do^wdͧE\ )UgOG`ŵI-:/I 㑫 Me_T0Mq(.shFo{(н|x;'LN5~HӔ/9OviQ}lMr䱫/FZ#?q_ |E{:毾, ]_ x)yL' E@>ǧO[6>݊öR܃ڇ0@W0|GI\}fxlyl8" # 5m"7&Rv z(EgNjpcMvT2BQ^fח~C{b'FW6E&7~·x7/X/>þ$Vp#vZszwBNLCt d_5(x6u:~40;ءպ {Ԇy+七 ?k?ya \#_lLO!4'ЪD&Y'qJÑ뵋ljDwE'}hoQ9l@~;^8 DbKg>ZC#בx(VYq[-@HnR:v'@m8b"\sf.%c[sj7Μq'HiַfsC뾃yGϳǛ>ǰz0tqPuF"i-GAs[tH&2%gkl$ ɱf<ٍMܽOGgq%jI}6Y&AZoIQ3][VUVp9w~Hmyyt$qzΖW@oSr^o֛_EM2%(Wyd# ]Ĺᜧ"դ3$vkn~g_QO^:HҕwhDF!Y| Oϼ?b+Es4s5CD ,A;qγX+ Z{ =8׬3z:1H82=gu AR V!9'$#HqXg1}]GWࣔr->d+>=ڐ]B!t9ry 纫 _c$Qlu7GţK^R\Wr(卟%{dijRz^,S@sA2-*3uo*: J 45>}z@kӋO{9bYXu%~2{?;m;)"?kNK~!gG9W#uUcr[-㝈*j쥡y-m I|gT|&Vly qӣWB[3 \86|m7r"L#WbH_ѻHzAxX;˲C߼$ڀ@+|<ڼ[oݐn9{Ko{hjK| izLg |UJkM! i8'"3HO6}0Iq$/sf 8!Ƥβ' TLYEŐ7":7FƑ=8i?ջ3dr|g9ܮjH}5CELz4c ԧ.+'dCuz['qkw>>R觮{[IZv.^=1W5-SƚuOBPB,{P?qI^@9~_&T6O;j=@~w:~[^rhІ/մˍvOd6҆M=kOsOgatz] 5v/gy|d[|HGuw:ڬ kM߿vuĈb'_QQ3ɾkKdfmYSK#(Ź.XfjouGyqs^E Aԛy!["`{܍::Ax9op!l;W I5.BD宕?2kz9l++5ntm_܉b"n#3S۹tye JIy}_Rs"'"ykY9w,Xz]r܍F#\_iF6!Rfԩeb8߁q5"5FsʈG֟*P(~S{ºM4jCAy3㋀VZ!B,e\Gy6 a2CD_ {q@ԕ\t J?RD*D<&}MDu|*#il< ԋq$#5Fupw+ŹoG5;-__6Z E1#cSG:m}"I통3ۦ'1~ Rʫgr4 F䕶XۑouV*{Uۛͭ/sbqwAut&|ۈ}ܪ&%Ud:W9%r"%Ŭp%aUĐlUrq]^OՌĥ=##5&Oڽ}ߞH+^sN4dX*s9h`xddL[ ٫c=)e:LE$2~o| lyx _d̅ O?h> Ҝ*w`}[ݏN88sB;/jl)Q;Gsw\@WnGϴ@L ed:uw[a/pܗ(D#o|h<p}r O}/%~uF+ZfevA#î(z_äqV6 /R s?c@^ '$brb{צtHlv{=W.%x?1\Տv!m:ob/KۯV{ŸV̋Qb=rgė/dѤe&J %_Gj#c'<Ro;HI>_#]s`Q_Kގc$=̲ί@s^YE kqo/2.@eIb{q/0|}^˻|nw|c~ԃA[;"DB~'z"גduI,c$0.Kyx " x!'n&71q{S~FڷңnmX܎iE6p:|?ј `%Ő>'#6y蒇 ] M?2/:??۬~أaLu{G ~7 *mIL; G =,FccL엑y6o* sTz'GB$جxO@㌛+ux^WqEw2%S3`j8)̏kJZ5;9yť WfW!hMuF& .~9m>,OM6^h>D.w+Q~NjczaM}]-42vú$ ;$Z(֘{G٧2Vu.a_WKBm7=2%u5.dFyn_:ـ3q\\]@`0#]-uC5_v W?}\iģa"6}mA[Oa@0zo_sq\3y3Q94Ŕ_^=P{%Q*F&<}~NiK/>`oMh% C2o93=߉q$r$z|p?#ss@@xxHWu;Hs'4ݲƭSoJJ;F"װs|:|K#;>__@=pFP D~M\]Xj=jE&Hȱ3EQͯVȷ-_&r\1miH ;SjNٛ-/+flղ^sI9ȕś$m~ӣVUJN5lsc㙰͝tOF&w#"R[|&׳c;=Јz}&dE)3v#!NdZT4PQZ7f$NDux=c>o"G;= *Oo/@ҏF5/YKy=hĈGI}k^ 8u!UOXxW ^l P9zlli7[bʇ%5>ctMWSJ#K5G&;ʳ5=ߞ'n=v AYOqwb3*,2Q=TϽngwkd)mgvEwDm0 dVJp>һ yV3=s>|Μ!_ʐOKk8egGCobbWryϙo{-Bn~ssJG+3BE3 s1 #4 ;W㭋aW q͟52vM/:cz{eːP_#@HyfӦO|Ai/+<,EMdܯ"5u-ڜJl8 ӾkNg")NO܇K#QL>2˺>]+O09h^ 0 WK 9_^FǦN]7U h*"{ D3!5mpWy!xr;۹ rr+j9nd̯}+񻹽j]ߟ׳1^GQWi }+q5F=ʧ8iG'Ɵ?uŖM%@'֎{6gqՇu՘9!("GŀpM~:2c#Qי* v)\9;ų>%2mv\d_k%p> a=*,@1 a_6ѕh[x-e,]v#-^^uy@',It ]%{W_MuX(20'1.~zbE_Qf(qnÐy c}q~q1!KbD/dmקev,ywg[_8i1m-} &oDʟBSOTÔD6}M5v;N: Bz `V~؛^'3V ]HRݗlϷrok*CUx'1_+&1[FZ`ܾF}Ѣ*Wݱ+v{қ}:Pqߨfr_7bE;H "UA4 Z !xes1Okx!4ߏ ?rIih$ߋuo*FșeD`^O-p|Ub_D]wv.o a. ^gS[1zU ! G/GbوSr_mW/kƫq~㸥X h@rך z.RvA2զ}(vPS $7?rFQ$/-*kUAH#5duZGs3bȸ\?u'OבKH\_4: nMܛI5* kvNV&XO?EyD[đ;Aݬ $c6rg+qT9~Ǧ> vDۇ" jW 3?Ww>IR>.%8rK0"=![$ڌ'}x8 Dc^ü5}>{tdDGfߴ|@_*S'.ׅYs-pּzyʝ|>_Ur] ɄgFÖh?Pd_b'$kR}>2Ղ`֧IQ* sOH&QwS27LGS۩oj?Z74pH ɻt}:v>_0/;Sv?c~WW;)賂an4R@HI"5w1ʾ jp$y+<&QEq:Nl 1vJa{{z}$(DGvCXFk|zw(#nyDtz ]X'po߯C\8"?|I~2Ry} &Rz3$#:,8{X/~~~> c$ myH;{fE͙9 ֪Ѡ=p`_]urIx0gLbVVLQyf9tپҷ湾Vj潦ĮuJ?/yY\J{;KN]?yz / |acچY3]֫ XD5 \|">Y߇xh-yu7'NR&h.y'^G=QonY ؅+V; ?f$zO?4=~M赒b#=kB}S+flcde~=N@?y*8 v|tV:ƾ11>n}c7p sL^'^v^T.awqK< ϟ|Έ>7[`xˉWu5D5߁P0 ?t-uAiM~\MM W%ok&?7@(}s+YäbKIx~M>we:CpaKX/roU\3>Ryby-polT>( "Q ;up}hNHv~YFJzj1 B:J! j=;&v(ɹ|-O O^W3 :1<A y~hL|pR/6{Oc1<@|On9djV'@dB$|C@xO ފbUGI$@P*8k*Dc)yO|+gS0jbYH!oS+RmB9J0|s( xv[\[^q?Y}]>ҽ.K4)y<*jg"DŽk* h*&˒?W+o68%y(`C9By}QhYq ?x<%v,w|bF;0rߌߒD[ܚ3Ṭ*_wF IE1{u zg]58yՏlRa5F!1OvO̞߳s)}xwE$^R5M2tՄ_H@F `F܍KY3?؈AjNqFzx69+O@ w2&Й"jqۜ[ 7-z<x7>w9ifr{O)zF|wyr}n‡{?%z;>;: *nQ~)>Xϭ? pLU|:b ܻJs-{2ZVVT gwׇ'D?}cm y81M8`sn =N/< ֲRazoH2n\zPCY™yt;6rc'$<1%|"c?s8O^gȽ#ݨSىwwSgD.[Q79>;}yC;̺B}p֪Ȼ?cy>qXsLp O(h~G}(^\ޞc$(x=b?$xuchMEL]D#cE Kd44!EX{%vE<ȣDcG~Gc"-8^31'mvLԪ鐹 K"lҰvg}bHo 9\>=- r1N63 f;A-߽:MOP(р ]=7U10c6k8gطZDZn?RucqdHG02b%\?9J~PHhucV~gK,b93G~TN6[{?7Xo[MFI?@U+vIdA "> UUv$û~MD1OJ߱oWׅc(gՇHBN`Ea΁a$ y\z1|Ddq4b\?ғ_3vli' 1~~W^nK',zޏպ}<*'{>a,\09ZM5b;š]e-COYE#Oe(. . Zsq.Xd:}Zu~.{vE76k8q69ހ,1ӋEka\s 4 Xנ"AWզV|'gw" =_*׊4da/&h& K M^~1]V]z='o?Dc̡g[%*Qn0(y8'uD0qKjB+\>>x9:kpయs xJj5F+cD/K]{ ~KB cðd\WwXnPA؉ڷy9Ӫ}?xuz_A#>sENh(#"PTؤbnX{}MXK5M:lmj> <J/֦xd?o~ڱ?_&~pd($G~vd S>D !c|^w@L6hr}'ESXdg6m4;XMg@FV$[*SiM{ +Ac4%|Hםo?$\w&R$$E~gw9~\PYm㱾% 8al#,}}gܨ rckN1W!^BNh>5p=#/@$^ǽwbOqt\ ȸU*z#\jO (8,ށ2nZmRWkbY?5E0L̃D_<}Ys_❍mA?zmEfH_BD8yޠZ⏟K?׿wMh 7q HF /iv6 ij/5ˁ—Ÿ|FJ[n6c8t19C7j1_qaEyGy/:-?~dyͤg򺣗4ΑW `glI~k7[WWEΐ0"rl@Ǟ6 bpsrH!MYUKbT J~Pb:>\ ? 5ϥw)dRi*ԓv&[Tnn645m`T19_=22qVwבUy@`6ۜ7xDº#M\/JH|X٪y]4 ׍.iBJ&H;䲸;dt^; '+kd@6sDBlQy; lzޞES7#„K\3 ه'h Y׈eƁT\p[cuu5q>Нyiln&y?&tZ^"8z2,@ >߲U|aɷh5r?u]oE7a=ɿ4}1zː rbd}.TŒ|0TsCWQKn7lo|L㻑mw9lx]ugg>/Lo1iܣ䒅@ՐɟtA?`ِX "J5z9>lzQ`,2* ,ќdޑ w΢;|r"ңkv3-1~`4ѹȁ.]ڪK7xXuV5,e?Iܖ+\J{6 ) Obftv^HUi(X@Xو+=+xgr 5:z/{f$49[fmBr~CI ļE8d{bpVafd_5Io]*x^StMϐ,s}]/ h?es>[Iy7x\rd]CW*8AnƱߧ=Muչo'-&4ưGd4bŹ!h"FGgE92gntk۶d" X2WYHۑwpyJ渟Yu.2vkn׺K| &#V4{YMnJ\7yqg9ycC{jG@E}du>뉼6!<yVs=Co]~'_%|7(#iIw?Z9Ą ?WM6trXb@L 7jᏯ3D'q=y7] *dk:1.%* $zA"EC}ؠQTBFo F>\M\B)/yǵ=.gg~o/-؀S&*tǶ[~ˇy.kyߝ G׬Y2+4;2:] nť !nv2n6ͣ~ X\W&2ϳoyպIPzO&g} ]f1t㓞ԍEBTW QE=uIq{Nt.ZJ"VG&LE֌DCίwg*IqF~p\}t6yF{&&  ?gQrG4 6m(A[}&CaJU.;A.`j$@UnSf[rqvĈ}Oꠎ_[jRѾYW@PEF_ E3"Y<`)FF:_9ˣ͒wOeNje[̣2;oTi 89ċHuʼnO-DcF_ܤ?i9.h:y?Z%L+sFTOK~໷cxm0 sCQ+}.x 0K6]O;\\uV Wl.uF౓_LVd[|D=i&X6XYWG{C+YiMlt"mȶ;.6{<;d"CI}{yJ2';\YHNݴ"e7KD.Ԕm/Dٕj/ҚwM%}42#'/M9aĥT6 HVW&"#{C~#+c=%ˆipAd98prW}-!?M::37H3Xur߭\S wp{ YWj9~~dMۈOp}DDwllB O\9A~:^ HlN{_bϋy8~)w^BvZK&KjN3!GKh|xMl \OuMD9&ϢQ D4݊, > <_ї(6,mZd>wTd%"w9b&5GӫqEU/z6)~;Ny$c9릛aw&^>z#nsFp@V&ʻdkl٪Yyu+dWKF$H"e֏g`_W5LN~M@uxWt@dc=vyќ3Hyb^BG/`Q׾:Ͻe}JMspE87Qj4-2CsPeTXoE5{iC ỷ34ВelS߷Z~G> ]5pĵbjl6Mw}>ape}] cNr.r^zoÞ v"ts|V2S3f~~s*c!sr$E'xT}$rGjD&Ku8+K%_ש6!::c{ ;Eo3W?k">h~7Pq=Q|NJ%~+j٘>r_ܿv#γ4).c/a ^#ќu9Jb$B݋ݑ2F?#UmRɑmJNwbvP<aXD?/T!bZ+0aaa,&¾Vy]X$Ȼ!*C#+(ƌM)P(7IT6iVtz!^nǂۡƤ";s(}JD.^˪F*f\Ziګk?M\9ޏ~۵BRܚ6ѭ}o}z/Ox)~o[|$1*ز.%8E&rDѳư"ƛȓv&o`Kf]jh|F<9o~5.88G0aC¨A"ZyC"YʾnXxBy',CGz>c!RWKB!9Xn{sI~tDZL'aF6#E^ ?>Ɲ͎#um{ȍ>:@~-swO4ٴ]x hкWl/'f.=K~zwg̎IVIsDJdCb&_}̏z\SH`wu|~8NlHM>46a9]ҸddK4yM}%n=; PȺ5R?g_F8zZ1['ؕSDS&}/'_LJ{ǙԘ ;WGfvWêSST}۳ ZD?45zDgylO_v&iDyf_d|Uz)J(lsME1qHćyY|@ErȧEBP# ENc?gCAd{ݧux-fq_X>)9O |SԼ6kR1y(չVġNv7NԠU:{ΧmD輢sx.Or~Fjy.6Fʣ#s} )x0}b*x bWCZ;uO\"eN=Ϯ`Y'mA1ъxzΨ(H8:\|7{Ns7b8_{Ru.~?L_O93~ƌ-Wt/`y!r% ߺ{&qa7mOgj̧g7l`k#~g݅Q:nBqy7ܛ| 6%kaKVر'7xyJ[; Lw0ku#8wQU4t)͓[yij{فHtޑ޾/Ҹ}Z]K Lu0nחMse֐c %1כM %3Ҟorx#<ļgmn~=.`go`0/}mG^ϹRk6&ޯ߭> 0#aw蹲=jƮ1-M| j] iX#},7%.h_5%!a3m8R܎ߡuHoyN544ڬc:N}DsqqpcrԵ/X@\I~\ c1.C Jj^/Gﵢc Q Ci&3Yο1v񀁜P6ٯO6RKDM{Ⱦio_z_zCm/Jj'cprZcioz<hرh.E6xe])81o75\E fnf5ƩN}jϑq=][}'Aj6{t?PߌpG~'ٿ|GR9VKx`͐!}Rx02QG Tv1QԌq>]DGp]{{!O}a:^dBo߯ɭR3 F^x.ZQr+M)ˑ0"ue"/j6¾>W;]nHI3o6h"y]62ִwEޗ/QSai GnmLMhL4y1G;}r?%[]"i~wY0c76yα9~A{!`m7Oj_U$o+c~'H=Mޏ#VH6Svpۖ7ǫ0Ƀ%klpC]%ˏ ; rUpE&r;Kt3ޮ-׷Z#D^l5GSҲ$8: 8lQ1B7rT?t|Y)7[Fn-zNFc-Q~&fG؜Y'}%,?=IʈD )۹re=Ǟ JFuEN,5`YC$l]d?UQsU.X(FKȎ&àjMX[3Rl 5zqIgEχ>͜Gfz e~,'\$h7k8WIyh>q7& K9u{o+at]j7heJ<*TzdFL{:}Y `Ni5?ӻY?x7 u?xhWC~N|\vϞFcfG p_JL$Ǯ?9ξQP7>yﻼ9p$q?'㽫pwc}mQn$2[-t˯WQ?~G:nxrgF"\fܺNb("n2*srnG"qv}[U"qdG>{n׏d7}ԏGVT "V 0R1DL:75jެpNY5f/@`&IYe_ 9?WS"Zhq<"g~y~Q&.q>|,H_DcMU n5S:5|od>sC=4#򡂇lY2;xf%R{W}$( mf =}>GS4ѕn>7na6E) S\|=vi XgFQq΂XeqZ0c٧έ UEoVł0|Aͭ?5W5\J>"cŎ ف'Zf۵?4QR~?>c_5r8xDC>5` 8Wp{NnW;AFW~V=B]9/8bhVqS07޴| %ܣ{R %͗v\7z6r=T5hu$H@&;d=29~\Nb`W/\/EdO>dOB6 L$a|p>ۚ͵Zcu[璫Pռ<8ddQSeNŸ1gYwlR䊪;>,ovx?w?0EGW?띂PAelx`!Yl}:޿\]?Hsgdc1q 4]:,<꫸uyCy/B]gΊ9!~ڇό4F%P2_z/DBlD 󼎖sOԗ}0p'C|bNjU]}ybuFk*f 2]W֝]RƽFk"9Ƴ/uj@t?QvGb H037d' -mI{7z7F.A+l>/z '%wBMr"~\ t"l|7B跤)4C]||[;^BP7jG!wA&w&2úX2${ҟi4C5 gBkmGiݼxV1c.BŖߍ]FםqN :#oe}_ h1;zck^^!rkWƋIDéuy#Sԓf=I]t'QFDf]sqf193?,2[`ae{/{#@d!ҬsD@4#eAj3?z: yk][ r p9To@Mb X Cr2! C qэm fyA=[ _k¬N$PO+ Uix>-4" ||g;ڛPwEynbӘY|a,iю`ӊI!Qf1Gz^h3̑#4_ik"WܺHo^'⏽3o)|_^ṷ{o^'Cb{r7?m>;}ʓp1_wd$~g:*88[o.ݑ(^oǸ9g4n:zOqy+M*bDQ+{̳w fTOO`"fNLk~dwdvI{7%G&}ĺe42yk|'_ X␵j{wu5 b[V\sDy0A3-ێQW~x=„j_FG\lfs*v+:5⒇H?br*QW~ԟV`ȑ{<0#~^|]cy81&%ۏ##5M^ K =@ϝVݻ5>r$fs5o49ȕp?! *Yw\1Oi֮3~,Oz # Jȶ4W?|ݽlA9}2Akw#7g@V\n ;`s]f}+ B߰95Gpƾ#;h{|7Br\WؕO ᕾȏS;Yb"c>$D+6;][eEhcvP=\:iZcԻ_ MԢ4ײF6:"p9QsYh_(;ZzOH,pf<Q7eeϵpﵼE1eP/ )ӹ/Hȗi ):)fiVlR`@mu~P~8vT\ SUWNgmȬ PW;|uhaL*J0]t>߾bx[zKi1o]@^YV2> sףD_ц`3hhGu~EPM (%O^`6?m9L2}T; J`ǁV cN;Zq&~@u݊˱2wH?~k;*N⌼ߋSJyO^KiD p(Jw8WP{#[no~Jc_3] bfъ rG> `CQsyzh5Аrn)߀@5 (xsSRY ظR쫂}QyWIV#.Idt6;;M74 \k'zP>p(g!$$;nH[vq޻]s+i'#nT <W9 {p>0y9 ['iLS᠟ӝ}`Xs1`M<8Ыи!4\ZvϞ%=Jpgx)!Iw%DJ^ ŗ7<֛("-x&Km*0fêOT2_,,zq軟#"z.X3Ne_w?}_/_OyO6_?}hW{6Oٯр^#N6t̹vDp ƺjoO @Gtuf@_~cgAjsM\iYqsn< $,l&8F`λjXy Oەe<={-W:/Dz'h96}3d{ %p= }%9]5y AIhMKC̏!^M sWtMV"OOnN|n)ƁÖS䁎Jܓ.Cd5qFu?C -O0vcMs?f(Yk|<"Ms?GM蚯qY(v=vַ̈́YbzVloG.: `N}"q{h㡍 eRDRY[O-Acx(V}`~E}O\vqW8R5]O턺3z|5w6 52Xw6c\cXzJpv%jӈ=eSWAHHĪ"(kCnF?R2YDDk R&~Wh'в{e;%"GVXNOrh†TU4]li) ({\YM>Ffm[)ωew SMOΙMS]Ѡ r>CohqntCoޞGB]`b[|]=<6vsuɃ2{{Ow=[++gCNleg(Q r%?rm:JQsmr낯J&sDFؠB=ݣӊ7cl hQ%o `Z@^kL>dhЬgJ$́ro`=J,ΊF7Ֆ~y'6z'*wt2t~ɲ%혐ϐpMq^LObԆdyfaܣi\w9Iˢ[Y48uX1yǝZMHћ}\t {LgftΏ\DC smKeǁ!|OIwOV hm/ QY8֨n-mB|2V<lS4Y!;Ԝ%YOxO7I7P}i.zjM*<:ݹ#Q-$a!s|-ΓUg"Ȧ ZflK' WEs"g_T5-~='@.[_}>tT\'kdH(d݆FS)]Nxs56 R;9GA] N]Snx~Y2 bQxfp8ҹ˪ysKTGQzZ9پsx'řˊH;AUߚmyԨ/찏lbE9\YmF CJvҍ 'PR{6Hm*[Eݱ.9t41hZJH϶Bޟ8-7FQ 1M=|pZ#Xuyr xƍziuC}glsQ&[ݬQu+%^8ſOg=QX#lDJE1~&KQ,3JG3p\"٪Uv,(pKT'Xq 4b5.Q+q:hݷ.!8ۊoo'':X8*ִ`4mK-N~6<,<'u0˖7_'HcWѺXkMŅ꼸 4]a`;N$*fF3-Ok:ȩ0Ȍb&c JY֎{v[|ojT0nCF"X87Sޯظ|/_ѽ-ꊩ1k.a+15^w+ﴠY5o.zI֥T#$y7X'TS6CQSxfy gDW {՗_JpC?gᾘ_+~О0Ogrʲ 3tq`WfeF` MD<`AfHI2-▪r%WGsq&M e~-66=w"*;x8rK1fPNYð9ψ nu'quow0Ka( Wy"6J ʩNX4`M' HE[J[f3*l /&Mx͎L̻ ZD;FUe;M+ES#]?1KvK@dV@d5!գhGqwqVg~GXG(OzYVLn>eZ#aVd@kM j11m$ 3{'9X7Ja(ZI4=cet؀#:|A4֫%Yi`<ƇsU P\/;K޺ބ֓ґcoUĺs<]FAClIݛ?F,@Q\3GyN^!%؇hGwL78^&Cױt1on ëvTXYx2H)q n .෪i+i%K0 Yscz7S2e\0OJ~)$mۣw l+]ġEQ=r+-qq@1%d!ą/h5r 7ymZw,ߔ#Vsy@; #>. 哭~|E.H̹DAXCTq;C%`eh_M QUMbm5ʲUxi7 ݺ( \:{f< (%}AȟϾFWGYm^_s ߓ^|Sަ{LgA0 qOJ:1{w7WQ禼ϗLNרnksi7=Ƙn(bB7cs>@V?%rbQ L[0eOI:q>IsNjj Nv^]kS18LG, #!k"7Y" lb'5g+3dr6{ ꫩT}A|g']?fM8!#qrZEZT:/\v#kFk6"l Nǐ:)UAib&ytr]^z@}#֘-{-V욻+JJ{7ι([=*'!"˃O p,g>INs5z7c`(R^o{hDd V]~1=$`{nw;p4c͹D ~h}j;AS6r5W"\ρbp=f,ݭPA1Awf+:d?~B~txj޹& x 4|O(쐤Vk{QkjŜ<x?)Ip4n>IE&nُِ=f%c}H$4}w2-SY-47roI8QhE?lq!FL }Jk[9נRs+45alM[шjIW6T)(4߷D7tOtݙ( di<]"Xt¢ټ-^met5JK+~ՎǤ};kO(Tdh J})_ sN)5~ *vbg٢:|wXHRQ:H_Eݠx<9MSCjN=f 6 kEaXs cCF؛6b sYMtfɵxEc}1ZoI\F OR1gA]K bpbNnR;s'ܫFo@jۧ9&KrJZqẍ]Slh$V*VHLkvL˅*_<:`Љ]aMi!4XQ][(Fm6_0$r.ʚ-BSGu@d\`LTc鹿;^~Z_7hsP/~|qȂLUj6qfq"Y'mx$]9Q͸r'ʔA i\cv}ѷ4TLH*xmrCYy;Szo)^..A#jV7%{E8 &y8O͝ߟ(2ͮɾ$p]ng^ &7LT8Mt_&,yȩƪUI{谹`iBeKB*g /κ/ {_=X 98k*x<5Gfz'I ~AHٗ3q{g:N@; @y:o8иhf,H(kal5;WjqF']Ex, Uz{20qVw ˞ OG5Kt|?l+͟of1{Th8sp:7&?rLz>2KV!!xTf 5,@ ?8WC'tZXЎ^Fus |cJJݪ:+HRv$K?YLYD EJ+<[q%K3싞 [Ou8ŝnjdum1Ł1x'ׯf'P[ -|)rI+2"utJ([cn&Z8VQ*pX1ZE{-;0ӘD^YB?y7CP;K*5>C1.!o",S>א&e83МȵU9AZ_s(Q1q"D ٯ =F4Yy^+ > $4lQ>\"<n%3~srU')-Ut)5Ĭ)Xl/ hS.B'OOw{XG*SJ\@Q5Pu_:@T_Քaޚ<媖\M"Oi1MV"M9^y4oQlR,㍉!z؎frKa5йcL|qTsfBM aV4v~&!>]2dad'b]{Թ?)bsb {qB'U7j;tD]'QqͦϮlkx6o,xQq{OQGy;ԡ U@ ̺L6' 4Dwr9+YG"bP,ٹ2t5x̙r?N]b>IIK9v3o_`+@ +_}t< qa*L`Yb49?oSc8S(v3y0ٓFsxZo5i|̧-A\i tU>p8#g֙|kYܿU(o2mQu{^-@TmDY;x܈w>éfu%8@|'e^:]&A={ ]uq"=T cY&y~9`'T%6QzEʽzLbDNyL-ᄝaցű Qx>`g?kqh}\$TsCy;O#zĚ"(M7d۳A<|$#41~`k 7YYB\0>ͧR'@BU,Ʉl_ ҁ;em<ۗ,w{G"FcNdN1li7brbh}#c][1o&O aщN%6תgDEv\:EcBĈ ^Tf5\>%d3''PFtr-7pJV3~.Ǿ㈈m29^7K!{lb?J2qO!wA|j /v;Ϛ4}ZT]Ob_#%8პ&;xAP$>T" eehl9T@l_l8]Mw+9]a`48CbL4jxfȀP(&ˡOsd)L/<7/+*{sMOT$퐘Uםu<]iQƭ1 :â! Q,Z|?nvY\j*7JhsD©DQrxKǡӹ1˩ӴIQ"Gc;w0(c~HlVyػbV5T )NTQ^o1q,i¶z t t㢴`}=Y#bʧiŴm>&Z+ ]+~#t5;B8 %.CVeo~حOܒSr?W|˭BLMwQ^jI(ҭ}l}_} eiւBL aߦ3 L4ؚ0腁7 L#inճMJܑ'$dB_G|> |\g x_K"iR784xXnmDFsKq]:{SJloBd%0Je{mSv^ٸk$^*ˆ}T΃SI{z~Ќ3Ɔ^n˻U?Yb~Բs˽a3P;yyUM?dFgӏ&5ظvuŧMc"Col DK |(Dg&<ы>ݠQ-[,t=.L0` Na#&A-u*#O=Vȡ ˭YA?&@gvųł x H;ݕB<'H8Ig4^HL7B݅qu8Em`ʋw;sUI!%$>\ GwaK"?K[k(,>V #1WSJnB0U,.ObO@,b7ߘev4xmR*d=ь./^]Y<(mV$ꝕΎBj]#~gSddFO8~]qY2|y &oUM(V[,snZYY7¼_ruT!˰I64{nHVsoYJ$#D&*Y8W<5 b:XteUg{,P @jRfY컚6Y17Ȳ0IqÁuWnpzLYYdGȵ2},} K; 6 K9p]gC!(xHӴg?<%(MC8vQ~ͪLԜEnW?Iv] @j[J[<8^Ee0o,$5hAʫx1[b\Nݐ8O6+(Fbkj9j׵ j^ŋ{dwǁrMVj.MbrpԼ,0%Zr".^D9-f'(".٣q!CS[@M"3)?C(,;VoQ٘@N]A<8zACHl4]|R歩V097\j 8F $sY!f 8A<<]06UHU j> M@ U>m][hosG> o%( M+T_854ͺyɀF4)j 6njKOE7iڋz;(&<ƫ!#w{O' 'zԈ/>b?i.\Oi@E sey"cqvoD%3iu{*%u:q&Øʄ wpi>e%f ǼcjboS"?Z,-Ai2jj-Z<~I:~/1{\^SZ_F, Ȣ P]/KS%UU>b~ N;Vu;>>e!nz&%"ĭ٘.4fzZd?i+(WWLTWuDvDy"f AMV:)NDn !ۖE^0Ћ2}b %f`<;̲H1(jcS8Mpd I[%% Ң1Gj&.~P rKN( WVj:y,4h\0ͭZT_P !( +K+7P1+}.FBit*.O,]F멶<*C7 {rS5C=෬E2nWP":P*1X ҹ]:rI.wu"0s@ٝ{,clʫ9TM8>_GkȪ :k|-뱈qf/<{VFyg+izإCboa%^?RY' ۩WCƠ| wTg!eI+9xoy>Qt>; U}ޑ~- `9͔vf,0]?U*"*$,nOq9je26HjYpF%||әj;֊@ڴ'|MDK|lDXWmal$8t%&7='v^N}C9W?'%T'w+q~M?^s/X:<15y&n-4nÅzu9v8]f~67v}{] w\8MWgD /ޙp߳bgO}uc ss]U&Ff0YK KtMyNź5#:v9,`Ą>,KZC {%gDZ$,^3 D1^YЛ:FYS=mѽFc}Q*؉?fv芊7-\1{{ ֧;'1zWpk=V0Rym3M|z]j.TqͽS\# Qx *+' Op>}|4<ܘ.lFi6nR P3oN'M6J : iG4ӈ1zm}a^pQRќOmx X10#K3^HWQ/7kn3D9q6@Mx#Ҽj+L  g>8KPAs8u>M6QzfusYf2CؑSޝ X>>quY "rOGuDKXů]1x}͝"ᗍd9Pish5~Nl bBBrPeSyQq_WLq`jy|̄ s'viDYqUĬ ܳ^sl]RudsOT^CeN  +)|wtr?ЗNmqW@=@l7YqM/*1*X-rg &K'+g3*[77F !rA>)Qۣ.w!^#ɪ_l ~l4!R]l ŃjNRU3H wz9 \Mf6;{ dT||_C;4 y"W7uBT9ǎ!%&ꚯ7Z9IާvQJpz]!qHb < RY<(eVך H̓SE@o1ܱ/yZP6JOV^zN5cy zhE:}:-+A0mpL &;n88Ϙ,@zϽ>2 ).]xE>E,9eDn`vDF>^Xcږ/.U\xx mϗ3iƠb|?q`b#ϟX*|ba.+Ja>*4ppȗS[?][HyxFgT"qݏ7TLk3j,.ЏC3!YOQǃiR_*FeǙ<^ u[ x鱥͝,I݄ƋB sNc0I- 9&f|Cl˵Ȉ&xK gFJe-]:.57_˶H,9_qP[ܷ[SOc@7;IqwQa;&!Zʰ05EH;AmITezޗ)=U+5_V@ٛ84s5'69g5lWB. qqM/>vŵAEs8՘i|u.i^89)gYhpi)y6j_!?JjOUW|T g?6`UA C6[~T ->͊n3d[M&lеq5Vhe&ȥi?8;O^ Е:8Q*z_BChl#1/B[LVɮ7;EpHLh, X%˳B=Wo@D/kp&PC멎abwj"e3Ʈ{~D?Je5]gl[貊 񔙽64F|xVbdSo.0N`.⁴3;sӍ} n)dGRwRLh73x%^ @y-SyLy)MI Tqh{߯b6#bRl p6^O w,0P pc 0|*KSJb+M GL= ZNX'3KHs ݾsqd3P "Y;utwY=gMomVL:jBЫcMܣM/3O^ϰCm4[Jz/ x_Np!O It@Vl+W77І~W1 0Ľ>Iqx+ r1}fjv a#wlաB}U=3O'вn]Ե;+lKcXlfCvXyO<ݝq*d>r>T3"L&Wʜ,$<@zt0+vCH$E+Eó*jcoL s)ǏڋKsB{fYuᏡ~вuK!$/1&MVx.ܠًnگ"ߎ z2fqdnÒS ߬ba1[q|nSxͨ_Bonuj*/,pGLSlR{~5jw6[f3zxJHU!ܢT5K\D*^t+`m"0 y7մMjZ"..g6T4j/TдE[YOdY<(ˎ@"xC&R,6/݄Z|!@pʼnYxF~i0zw.|Ulq&.|fW:9"C;r;85kj|ۙ->&c !>V&(t(>q ]h`'8dxZ+;:Z~/ߧfjq%3 Hf5Kj\ S;A@}PV U c#U4䩿 vPSs㹮T/{/KTG}~h+7JhMWo؛l8ŋ *i}hp :2lgGbSlz܄EK\m_[MUr}oPfBh7ġf…LWIF%?n{םsY+lգ'҃}F0=Mw5 @R@F^`18bASrnP#H\ƄOU:,ƴ_Tsȇ:wApo˕p{݅ ?H!?[|7[B՛Ӭ֫ >Fu| b9CO"GNT\>h|;~g:#F7KEw$!x\w@Ўs !_k裶yq[3ßݢC"ѮQ fFrBކ|`Gn*B(y~7-鲊AfE{Jxpz@oW3"(aLd3y!Z+V8UV -n=GTXU}+H5u %k_\<o5{zOe54 ~^;V=o¾延p^ ׷8Qu"ͤЀ>SU|>N= ~ ^z*%>K$Ye+vKK)[Z4,[()^E rY#G;P@\rI.7:⮙WKFN1E,fvѿ 1:#'K ]pSYbPĖkB]WiBDqx 4hkܚz-J$(nUeNv O-;`Ѿ?goF)+n*~{󨣮blDqgh>chF XlBmZ` iks?ijM>خ ?4Jd\L ]yf>wx\5ni ?궦,kDۡ2{Hd}O}f\_lɋ\_P&تI ?ǣﾷ}|j-2#3##|;y]7n'_cNB:-5W:p)I"X ujvSbME<@~4V?Zdv2wjCu 4&{C,[0t݁pR F 7Jx =Ż.8"4r>%Q%{q 1boAg9>Mį9 dK@ +in3I74JrSW)X!m$c'V;}O do18=wA5`تtw+#w%.H$~V]';p)dG~sqN;W7Ȟqej\\Δɜ.+5OObٕLaI . j1#J2|_긧Uy*LqpK:4vrD,6XYdzN+2q`Եm) %QU+ɿF>kYAФ+L5&Lq{vm}!S7Bfl[cp9=7'Q KүJuӲvd}9nԖXx5K*s@7“.:X,ݓ-&\+YԈn0h*MdmR83©2ܒ -,RȯL=cO1dZ"LC-Q EI)W*hj@Öp0l3M4$8Og2s%vy?-0@, z$yq.RSqN}>J ~`*zcUOinU]J(+LNjƘd*>_O)d+pSmF'L;78$I/bMXg.L0e|>6T9<ϑ:׻c=/NҬNs4{ܓyD[v3KKPtYHF|ϾOSGˁRO"~n檴/ >L!?o?QN8[A0޹m}) 'bڌ9ʴ;rO[rr՜Eqƙ;s.m.̪Lc̯MS]{ e -2* O IS-J40˓ R)6XDTI坘@[[HNDi.q Ķ%zMYꉈTHqm=`c6U0'sK8p{N>R!C9,.WdJh)ye+EPz'S9X̛|Ohuc./}m&|)B\NfYy7$~uï^/!WC,!]e-/pY\zrzQl,dL2NyPqI$*CVt8C3IVNAeDx>mek]0uo0Z܁~}RH͍z'|[ewܬ$բj-fRHGXTu>axo/ p:Z;縻' K˟&AP s@N5fl8mL2m K؜o,}aST{~! *zb'>Q \ (Ċ ^m֕`pyu:.Q{AnRSvˇg@)Oc^S87x3ټOc EfFŏ6BMZp\ǖyRIӀ7~H f[~INU8n喍#lʔJ 6)"a^g8m{.s~A(@~qt=w%}iv:O_7yч [@ZOnWIIrK6g&Z[lӵyŕ%$1um2B0M!Wv Orɰ+.iCA)J/x8{ix<@rJ-3>3M'Vݙ+O4zM͗{ QePq=OtMlA$Ȓ+"U!M 4_TT/_@^Q'ZfrWt mw p։eCϟʖO=~ĬѬn<@8yּ9h lJb`@Zqwmq5ʍgp]xi#vP J&&k-z^`8N:>GUA^ ߜ1ZvjTϗI<;*_}N N±ޅ6B XHHd`'%X^hGKIԋ'pS{jYTM)6 |4.j$ʑcAf­h!ѥd('eXpVH$A/I}'W텠t͂X~ BCOIOjtz}m=+>T#N:Ju8}4Tz,Г)>M}=Đ?z۴: LHWREL\' ԇ\aJ”I#W'|:bbAݗgcp#JM(DaoZ)R+zQ!}e*a*}*7(/"0*ƟuvK}6o`Y5%e&Kߖ.^5넕/hxS D[E6Jʰ.a1+1$Ll`1o<&x WQ-lÎ^΁ϞZOx\55[r3[e ،[1h Cm6JinٝV/͎\X5⡼Ow04DnR7UoIR#O%sk_uQ>;wQmIܙ2w0bXa56,7n^Őm=Q󮓶}D;&{(o֧ T#yKAXXAF9nGRZlyS.!>MAc1utVF$epO6yY)%vBby-汯ر*5JHq3Zsd_VՇBإ;^KF䲗_:>~A"Bx:J%4r{v( gL%4b#O/yFtY.]% 0` 3^JIgD5HӦ}cbFNTHMNRch="m5Lٹj8i?Ay.|Yk ;ET:S_jœmtesYR툱hT߁q&T` :6FB;N؈:ׅfwjw$$6gCI ɝ?Gefh&Vw Wm9L)&<ŤqɓMUFk0qӽ\اIΦhg]Bjߎ 1l.g$}Kk]H qcu`{R&=Ծ?AaC=pL' 6tqZ@-x15ŝng(Æ%*|ð5qN:i<}Nkh2_%Jb~Žq]w]3*ϡ¹*XMwQ*f I.E#`T6:+'L{Ϗmyi"9!yDRLN&ƾ9\MJߗY]{2ciUCd%!UŕTbDtAX"fը6Qf7+ů|kEhlJjo^SpeW:XA?BQ0>PyVSA켒-Q0=r5YǐyՃ@s{3 8B^|HAGjvC?`؆k'kMIVmS{rP?cvLOtJ-Ij?}kx̮_Sa!T*,SP> YTxI %iXҹzSe,'+HfLZ ei- '%aL f׳AT J$7j|CTJs f#eA69mr+r7/ƽ?<4p"Wkq_[_#'>緵Ja̽[YYG 9-QӒw0eU^h H; z!S?Kz ;!Ŏȝ8YyigmfժOSXO=*ŹTt}kExF>;4{ vHHs! خq{F*#W?.2 /i-M L(z9w>gvثu{kc_T@GdgbA<'0QPfynIxmjɕ9w3؀_YkPy˄Ǔ8ma?[J ȓ-P=*mO{kvcLbQRm吗D :xABldcp0E1 S4F̅-`i.c AIikNs]><΄u|jx+d}ѼcK_>?au'8 Wz ΔT9uI@+0 ,jZk2{nX;N~ǂq} B $@F, `2u?/˥ e嶕id7|/{T]? <zOFdkN&?Yؼ@] Yxq>E."5% ۞aiyF^s2:G{D4* cR;Y(ojݰc1C1/_

`u߼k4)%S pۻ^@qʄr:YڬWCy1٭]}(cX.|D)}5q?s2IL?IFA dsSDr X Tú) c|Jqq\pMrRdʣfYNr ]zig1ԙL/(۟Ǒ?.c5ڳ*U'덗4)r)-u앖gQɵHnI9×ڟS5E*8|W a}r "U`>}4|<UtW saھn|Еʞ3qBQކ}&H:>,щ=LY<$5HrR-f(}DQJr F ܪr*X- f*"@rd"b} p܆v^s"Of?qB^|=&$s~cwl0$y:cx aNۮT]Rk4?4GֲZRhZ)KHɩ9 y#o,=+ zR<2MjTt? bTG `p/2ӛ 7U+3YSщU1 *Sֺap;zpMȤ p۟j?xLx0J 8ɀ86-zo?Zxtۃ\UPonq:fU8'6׃9&6Ne"k ES}0ڗa>=Pnǘk{ }4;2~7PvM =jo 妢gn%~5䵲_*Xi{#7*H6 > aF:ej+ٝ&%´oǫOqlh'1/YQMzL < [,cNt(%\d;h# /UBuOimUdLs}A :0S<㛿I};x]]1\"^ׅ dF1׍rwYΜtف*/Fr%\Nx_ahxl) =hӞ3e^ Qj#M-x:k#ee!#GF|?uM^\#8LmcP/ KV ~Hy JK'p%<4ɷ#H!k!_#k(0ǔK@M !U6jBy'M SӾ;@x1/uf%#qu; > ]D0S<-xy9/~.}(=l` 'gan6K OŢϠr~>d-Ě~\7o\͹]~ލNՔF.7#|ʟT lPp 9Ҹꐊ8XS?umRI>9Dj 7n1L88о'V.k.ϓF>|ܦ ǑUTM<=5B:}!7Xu\֬SyIH;&=#fTf)?&̐]3:Ј{jf25{t,S?W*&'e|j,Vgs{Zb֘S,nʺ+{ f7@!'zȖc{{ϗ%ȹ$)} {Jl~M(.=@ߧ!}{n?u>ȡI^kyTPXc~,X`\*gÔ92km? ╂ !Drn%I3,/)_pwp% ʍVĔCff(HQ"Ɂ@ZbDƳi dO!J?U߲/ @Eݭ|*G 㶍e֐ G'7L?3\o& ?+.}y>cB:^gG'$Df!U.)MהEz \1^dGRh \t'!V^+6*vwCH ];؏OMMP7ば60}::SZbG12:oʕ-i0 &anߋ՜%v0%yʧ3Cjr/0o `&fzcE76\k>sFs{}$ cӜTV!Z:EMgzaNw~B.KNm0ͅ\@:H' .vy>d؛.CҎazƝԚlFw3y6xo˗Ĕ \td%}-'ie%y $V™( ٦q@e |2',^5"Ѵ뗴.4̦PZjʬOjȁB6'V)SKbub`+f`n./Y4A0@@1=.@EiwBW~^uesS'f@,?e"9&EUd-aP\eNgbJ+>ȲQ>s.A|Rxpf+jO/'Eɼ `S%ӰȵJL&ŐD=A(p;[h:uLS?Mxn\t *6W>YoA!]-܍c->ue(XZZHX(.S9Ig_P<*1X=h!X m0?PպIGBf%.x)W>`rf+zk?,ZRyD=43Kۓc"I<_hW[ԟ13ٵXItiXRV>7j/y908ơ0'Y[a1s؝WZOUn;Q#=U@|Rgb>g'svڛBKa}IT 4zim()Rii珼P"-1: (WyAhƌ ,,½,D 49@9w] nb9 ge9w>øo^Se6Ne/kyت<53y+A2fd6sAA@-Y mϽM3dZ1RGay89Ȧy5ݓv /LվAw4ف2fH.:B͚A#p`*ON!l &o)JYoJ8zNlR ٜm ^>JQO<9IvV$i`P xm$Xe )!^!KcyT m"n`rӈm8\I!/s9KfJhl l=x5pI/88< e"MOMJ$WMk5=#uι9PeIuMeqi25WA82sruSH6{֕"6ϛ_^u~/?o$Je5_bR 9-^:wCSڄֱ_TO%מƊ&~H玳\No<¾:|'0/)qQPN:s{r 82Ssd1 ro J~r&hVғdlwߛ^\MlPT5IO O-dP}*fMT>. RB$ͤ#O;x~;/ U}tO &ymulCc)Iত|,n?76FcyaW>)R.)ϗAF_[8L'4P^i&,>$ ~d]UQml?5-2&"'F,\&5v%%Ω3^a7,:h$Ѽ8lH렙i+"4JE[b}N3J`2 @:қF%yaF%_7ͅCl O5+u@چV`NŒ]b9[>p.z]ddCr:ͲEewn"> dtI‹f\Pxʽ?QzB=AKM$6xjL-2MIwq'a)WdcI}$4u' n^5xIӖ!R#  ÊL+X7jv/me6`^}@\k m LW9b l)W'W~Ǘk=ݻVuԓR a&TBaK2ls~n$TӍ&p<Đ y%SIat^[6;l )t͍q/BC2egiݮ#a?@(8@g /'w6ro]\ckBpElیyĿnƙxxވ)'yV#CzMyW5aC![BkO$v[}X6xő\l1P]oIdeaɺ5!aIIeZ~ Su>uu \34"Lf[Q~JK[ H8Ǵ dR5grI-R%新 |S/bJLq͂E8~c 缚[Ws:792TڵϝT:RbՇ"5^{~jm&!=vz$SJ}!$h3~ {λ9Yw^AŰpneK2)}NIP\Wp^6٨3gyvnw0\({J݅֒'Yvw4 zmK^fejugh-[0-"$ѝզf!m?BIAr/?>pK꿱(ڱsYk!Пːsrv̰qΜdl)S=lzך[Ғ ֊Zi+I>N -A:Mwq>}Ԡi|ÞcI}ER[,޴<;Q97|_gzhͥTWSZBj,\ܰonoBrAW>uX 1ӵ]znM%s5~@%ALWoRn;:IcZ)ǿԫ|RܧDC)hb72O\l7{)Cly]gn{b3W8=k`ܫcU,*&xQHj'% BZ)V!"ޑwՒ1N[`DJЫP7n'q~SR NM?^@S{re~z^zEa7VM~S)Rh, _~IS}@oM`MU`5yԛ)r@UMfY֛WmFuV_yY&USA) IX?)|bHl"I1A `D[l̉{6R:Nh:wlohgv {n~: N1W{k%Ϻrz'U{` ʁg{e{"PD.d*nM}`x~?RYI{ZsmB72{UOJ(NvBC m-3>Av(5Х_WJYB)hmnՒ~Z\7ؒnXS ,Ic)8Z1JyS~lL蘪&(t3Xx4:cf >iZ'9)g&5`W|H$MXĽ\2u'5鲅zN/)u_8_BAu1kV3 3/w@nzzK4kO@3$Bʐٓscb6CQܩ <ڼvE˻sֵ݊kv)ˎN9w1vKNw~T IeR&F<Ή}fѼrqI.TN}-11l%)EW!)%Dj;-iʕhmnlk%,A۸%?Urg\E:m} O/ W{#v .di9& ؄N0aNau0D/3 Rop %'a$gX<8>/cS[JCRxyzܘޟ(}mJ+uP{he޲5]Dklwj`k% TJ LQ>ɶ_:I%DH,N91HrSC? B `AFtg >9`## -ӫbG蹻~,']+rgUv1"=^j\Ws uzX9.^֞:#73uĚ3rSlslo{rEHߧda q&d@}=_{Gw9h[CA[ϧ^ll \ ʫak|K=|*#!r0I<zOFڗʭ_X9p >BE='JNH3ID ^Hg@b%QO%&EwVJkna]`ۻ7K9gRښߒ̝y|N3⸸Leдt;#K wΚQ%Tbo-xL4,s [6^4PJ!=>}m-fڱ$ hlj!;<':֟EΦe) xO w< w=63-p10)Rr**RGd7!.Q2 䶞FOAO&?ج?黇 koVM |CzYG=Tܰ|=VK8*N 8 \1+$hƣcO%B}Aeq9dJ!̤ /9z5 kW!["Hئ(A|;SE%v%'rE#ʙ l;)I%ߟ{ Ҫ5>7TWgM|MQjfMd1>u ğ~u΄]#{N[Rrh߶bh |ZLpn2e! 3EZu|Xy(X'Kd-:z ⮏SRש^gApSk9S ;pSsXg`朠S ӕ|}LH:J N)_-يTB@g7J`tJ 조QIovm{ӐM5\ۙ~dqO<ȱrr}@W8T-x֔*΄vWp3.# ²#4zRk} L= Jz>D25K1X!J@ħ]&nIHFJjAC7;Hc_['s)cЖM-rzdNw$5|iy J6<7q ~()Jkϖ}3;mBs6ږb'0gk~A*YWxO*@$yv8}cNfg>u+0-]yf̼X!b⼒?`vj9A|߈t2%TS2$?r{ L8j &SN Vьϵ#`8I^Fef5܋ɴ8:پw.Ԩi1Oq$9FOdjN38^.2BKen9P3goCa?o,K9kyt54*;n]sy&Zx.p1=G <{9c, E 7)i< sR~J4>NxbR$܇2vEQLq'kAiXgj$\%фѬeu?Rp(:aڤd哻cAlL:m)ݍ5!+1u6kjsDrBNfkbνG<6$wzLg8`7O@H.ci᡾0^J 5 =i+/D\$Zsp5L[eT突ȿ.AvRXl)(~ϐnqMʘy {M%`|~n[2Obi`2sS I{,(mVm֤-0D8`,dk|[gNK`&$02G&w31*״9WHբO[^@ZAm.$lGTP?-020) `{guNgvռeedzR /T)jF>3+T&gdY8 AuFN S4ajs*:c;q_i2KR0-~<+WmK.U\u:6KWJB=Ƕ%p`>U2.HB&$m0$\땎"EߤRp~~L>V]F̊03FxN)n\&('nM ۧ|gN'FZpb& q`lrP< Q=se,L%QTf~kb9 C%.j2<믍Gv*)\*z}:wp"r(AGϕMw)P|II9)lj9_>+Yg))9cNQ-I_e {)^Gp dNHu뉅n SH< 3{Cc")9=o|~+=?>Oӵ{jJڶ~j^5N^m6ԵLJBGxvֽ?cZxY? >BJPfWF4_ΡxLכxjQ&ӾItY[rlP)MA?.G#eȎETaI4礭T .|\z1X-tSy'˼y~`>ڇvnd'ߕ9q,yN7heq x) MMyCmˈAf*_Kk du#/AVB}~aytEm$[C9\?9/ݒIHoBi]&"hTu4t+ȡIŎP)w`&JJL0ftcA$=?U7%%`N{hslˤ~f?Y$cy%oLG&SYN'^ 9нO3$1?ib7pb lȫaSI|`^R8Ē52^Iڰ(T=W )WKWRȽu}.|<*, I#6Y"{E[AIFlCty*~aȓN Rl^+ѷ%S3HdYj#!%D#pq ~+rꙷILfCSN.̫Ί+7 i OD'3N;#/1G7*.tN)NfWNYf^5m9bO}ͩaƚY'.I*x)4vn|Y};ǒ/PMÄC_]\͛tՐ ߘit]{2Ė?%)Y7C3| ,S]䭳|S RCi'Aܡ Bà]A>:R3rF5?0ScK]>RȵѶ>k]cWVD '"4o5C9Ye&TmU"ICclb-Xj͚gHlH@e7Urü%/6Aɢ%G MhNǎ3R eRL[H/VaꡔuVbw"ԙZ('X'UdX d]l$Q-UڧLӃMυ;ƨnI杚Ī)sѝMɹIȜk%$kCέ>%߾fNSܩ3թ!v̌X w޲MP9m>2RĹQ Zn u<"=%-/{'QN|&UtB?GJ87@n( }k%%WHq3Vfg֙r~۫ò~@]/[!S#'Q  V \MT8J`98Gλn)ts|@(U;x?`˽3g0"|rcywӾAY`D@2lhyﮓ$[..\9d)UPDRڮtH X,KNjWU1G|NŹ{uOz,>9i$_'6^MU]  ` ȩ)R ᗓ_s()O=F0 ćkl]eK~?xћtn\,krm ǠxMkcOYxrظfcBvz~P9bB.nJʢAoǹMjeMvCWu x}؟rlGA,$9&#֔$[eEhK OpZEǬne b7jޯ9T?*Dz=vE?uwy;~I; 77L@H f~{0k?F>4~srY*iJBk\Re'[{'X29>B*Ԓ0C=F#?<-(ʘ4n-ا&I>c.J }k*ʽ#ZWuObF*.a1J>A);=4dۓ5 Jx~.9ݍ|5->+psfL)!"y7u ;Ghfl##5"@~lē@-7;X+hS7IKm $ָ}Piz}5ILe#PW쐐z"5LD9+m0BK&q;ܾN-֑ ֶse3 Lݱ[_"FJiT!#]B H&;m7ٺ-';ޫ]+0]ESV:S}o߈lQɬ3f&TS0DltWIt2,)XҚlaF|'`Jt~aɊ#Y98_ɴ-lrWrnLbM޳j0+][kOS>HY(y$4RL6>{JOjN2edϡ8>4pkE67V楐n#BE/oD=;@6Jw,YN'K.3W1 hd}SuᶤA?,i\eK:5s4X{1@~_\FAk@l }̽Ydl@"N?ITiCRwRZٲIurPeO$^,i}F{#C>>ӹ1tCVk=(Lj9ǖzY \4`&ͅ YΜ;ƚdlVyrW-q/~dkl1LnG U"5d0 WhI TA\wތ IrW g4;)Hm%}ؾLtMDuz||p7=g9D%S`XoV,=wXw{a\9o4bmSIFR%7G#;;|"$Tso)kʨ^}n6ΛxX& ).ui~/~786Ht?m~N[dkT! {T"'&{AS6Ak?,m]nA`c ]y<|b hS#'SץIr@IG8P1Kj \.I~Nbmym,RmSnz@KҎxٍmL>AL+]Wu:HbPtlV#{q(͍mOaC4Îm_ɬ~Q ˖$qxw;ÁQ1:UƏ` \۝kR À$@+&r$~4I>D֩>J0c VHyd i6H-Hr5rI!N$ڜ9zonW0aO" 6c4$aRuo1f+p#Acn !7Ѵ2/?ׅ xn"kM%A44g{c WVvŚ-*AA{_> m뜝0@ƚ lrrh|fvљ n-!HpD1UP착U˷Y'*@%wM; Š/DO*Ijb5"jǧ HzTzB-M/'}I p2:EkԀ\'tjvFcp4) t˝ѷ`x^% Hbo9gIF09m0aTlֶri^ npFt5Z.24ɣ3ys*LSqc:yo JgbT O'lu|^?Lh'*S g!ll:k7;G9Zlh"G4O,-8mfżR\ĮrS҆נy6 lK^,L2&{9IMQR%5>`9?l:@y_81PR9\W9S=xnwaOsg.%p .D@ d h"ejˎlFGn9_>_V)'.C,Z0؟v7u0;)V9;ĩה./} Y Es2IwL U?_0Q&BA71s-}KS5L@1U;9XUzB_hmI.)W^2ĮF_䦲p՚Gٳ.xހ)2^)_`[n= 4 ^Z£]yY8q8ll^ b&IR(*j2cM`{N~9%mQɧұK` ltׇV-& g0)ߴO}81'; tFbYM;uB ۓMjD*'(eTxJjV!b ˛!M YОt8ǃmCl.^R}K'7KI=a.-UE~"À,fM'ӁF8>-N9^k'kHK5E5Qx^e5BHa,%ӗΡ;.WL˜-n5/\s iIǓLJ"?x?nfQJ( \p??\,yԘPDe#JQ9=:I^OꄹIguSg}$jgzX/Z^-M#O?UIr%w3ʧo7KL"Rl9DR) bK0/,h\6ߥcznϛHZ<KvȃlX Mro9NnO='ۊY]uB{yhsp0Ad>WE=ߵm;8Kbt,8X@%IJt#BFx#(5!u 2kaN~ƮxL]\0hɛjOᦢ{Xo709 !Dt+KW?']02qy y[nsІxXɍovYknToݰTDcuZ(&,-3WV~*OJ(Mc=ʹF'P^54Ty3'u!X13u?N brmtk4-"Zḥ,$9]uh8b$~iߞsQpcS%&棸.+gcɊOƱ\,S%ϟ}'i{&:b1+bjU>嶰=X?9#ZD%$Ֆ0y}' Ǒ횧wza5`Ӥs2uvIS1|eW &(P:>g8^[]&a1tA-W_ƀHsS7AI5FԆN {iEEWgOg U᳾up;z/C(*)瓣ɩ 59I"LlHi9μ[y;ow BV*y {n_Ey<cˆ7ednNqgVNƺW(Ty@(v!PRHd?rh$, Lt%5\8rJ8(Sy=mT#ݦ\3Y5<ЮA%zq̗M`s qstr zn?ELyWN]l_<ݩ;CY`GVi; D줉! ~$F#SzlL.n\L1Ʈء,slrMi&?3?Tx5_)-fwZ;ͮǵX$/τsQSaaϝaI?)<8@sSA`d+sɵ^ 8}1lIvVO EWI4%,1{8ɿ Or+4Ajب,!K0=M&,w4}D'0A/+o4 y_k{V" W#ôQYm~ -ax9;Dr~uPeZp\wv]N:o0Yy+7ĵb_ үTbR|XQ o,=w0dI2%+“]-5a}hC1¿gOې,I܄\| zk>T*6L\&&]ƃF:epofs+g4y~XNKH)0˛[nOm8JnAҞ2ijͧI2H}SJ6S'뷙 iIMtB'd >F9hb`;=42o+Oc7Rbf}Jt߻XypOgj<8GfYhYJޖJqZG eEU[p'5ng~jOl4fRs5ˑ*+RǀǯA* ]uF=jThmffn&ؤk2?L}ZpjCo7 bd/r(S1Hڠ'AW'C_Sg .q l, b|$Oܦ,3\TvrQȍHHU8 ϺCٺ*,cTj9-g~\iNsg#i 5b[vp;ɤM\ a2QO>JE _{ 2|,4tulȞތKU_>UMFv:/qXR/=@R9Ħe~vsZ %f BC{у5n'y'pK(Uy%nKr"_-SݱZ05 O҅0údXf-"95!|q9 νal.N] - 6_&9%Bpw椉(U;ہ9 MES, TJsVW7[ԦFS_m?~yO>6QAy^pVPF1 JCG2;{z:wXlus~|&=%l,ZX%~ sĤyn'02}}UW߫Nhb_Y8SgXO7Ι#U4u-؞jy3:g9$6j ;AѦb`PY%FnX9gNo٤<'[&6qq| ?6aGLS}˂ gϖ{C:2/XD&~ (D\62f-x0%LI8!үpPq3:EE+l Or0QWD߳NKKDco{HHLK4Lo7yGaF=YJ֠x_'w PL?9)++ɝ²vaT 6#.AHVznu afH$X<=^).gV A{t`q.tZH\V[?h(@2%Mw?생}rhLձ6K5IEW19 V]xe;LAX݊T_cǗ%r˔ :k6ATc;/dJmʸ{v nff h/O*$;m<{4}cb0XuŞݜad t5a1!U;fQjK0nt#mhsL+?Wh/A\7?`O+@؉}!^/[C*,#1t/yn7'*hio'o>wگK\Whb%Ԋ@@R5[F{l9J&<%K]y\D*d4@.*JYɑ{)3'D;ӶIJ6S(v0IPS|$ "o,vZ_a*["Ҷ(ڶn'=7xa %MqgR_YSk Ap|9%I;50RͽfKSU^;_Z "Xv11 C=O'6/Y>XGGvPrgkHq)R 杽&6L(3ॳvf Ay pLڟ}?fOV\^t_M-W{VWV(= @ QN)b].oLَ?c%tυqpM@P1]lPT; F:I@OʺNNyۊrt NA+ mH苩/ԓ- )'q/V͌x9?XׯEكXsm'HMu򱶮TXW@1]T+CwLF=? 8Fb؄e4౺VgZqB5ς_^ixEJm;&ĔlXT k{N7Y"GJwe^FEP ~8Ss*^^ELJ%9n5` lEV&?6<|j^y>LK*c-Wiw#8Er@OR'<`Zk:Ͼ积%L;fOZ`'w"ʘ~_-\uPʃyn\CT|v1j!Ld${#8$?:]aeϿfqEFJ|xwl} K uSz+N}t0'*9bcΪՉp0mHlN3@'ח+}(pЀF+5Ԉ@dB7}-M'edLu la\KOY8ˤcz&%7bݖ+X &rdOfp,]}z,{ `D^ }s KAH\<10^H8P["|'}rD GF WOP+xʦKXbr6 p _ r?N\4vj|eg8'XVaO`/m=+ёٛ%h"%)@kڪ7^}a/N*aHȽOC*BE_pu0f-S1ҙ"O0okҢ\2?9 rk7I،čS^0\K.J: OZWs[Ͷw! 3\(`(uV0~h0" ^=tZs{|.+HU "\/ɶkʛ+%F0%};klvK [eR2jx8ugǚmFCat=<1 B0ZI8LC9ױԙ špۘh̛y)e)L{i I_IZ]6١3KZVY  v[vNW3'9qsJ1eʨpr*x24W->rFb+ a*ǕK#0=!S€Ƣ9X{IJ5.v7?vDžw@R'hU ~'&{71 `'ྌʕ,ef`oc1G"=yI 1 l7מbCDWglhh^XBGDl]y ۖ)&.M?o<;*ufv3&TIp~ИK lFĪcsN|Xܪi-o5>IӮjpMfJN)/=>5_r~"jeU9:r7509V͑0~dmN䦐녘"eJrߟdeUw{r];a, )qԾ~wh2ŲL<Uޞz9@8xg3 K|V։8ɟgeHؘS937Y2M$>`%U͠_i_)~>`1|5yHZ|" e~r,K?rWJ˃f Fp-s-~) SPx8kmz6\su.r I6Gܲ ';4QwqL 8*((zH&RU qr2Y9{I;SU7IpOHFIԾcJ? `%<|-!Uou"g!xͪ$˓}"PfG~Y&d* NNidVJK[m-z- )($ڶx&KBζ`h]B-?5e'#sO;RuMs"<֔^K\<H]'7Laޚ3ewO^;fzPfϤ)[&Nۦ[gNJy),ѦF|KL|(:61P3Jed-/9?~nYرOԩH Y'(y7ߘAFҢkk`{#kǖRJi MXTEXFGv '.'KZ +x-_qd?(] ѽȶ@,yE<O;>sJoO֞!;†-#NNH5XJgr?FnVkYJOFQN* ܚvD%m-iPqoP? >O7Ypn$.;ygO2Doq0gR^Ġʥe#זKĊ4LG>"( +%F2r|\{פE9u>´fwBQ:؎J]j!r+ |e9T1wv}M>؄MLOQ*&frmNwD_|FHZ*Ź9Cp5odPRn-QE,ډ+<)b ߂XX$LnډBL[m&q98/1ιv6N 1 ]*N7J(̫%ܼ_/c|Ī[b&ޗL ˅CB:T9ʼn² Wv]/?K9`w%UZA'db3gkKP^Ebꖳt%t5u1IaҎ f,W[`JҬw&񾰵^zDԻ]:%>yL@qF |䶟9QC2UW<"i_/ӨK`NA%զ%:r&?&^`n 9K֓5U&j{;qA6}&U/m?& Ÿ+gq$z}%q$G/TϛBq 3`_;Ge\|PʟNba8زOqH`=,J9uwRw@BV$yN{<Äب|-{A<-45!C0S|g~Zfe\w qNucD)p)"<Vma6ctiv&78hKruL;'nA;5>.e0^Sԛ<LStQ=O KҺz^d@q^f"x&ajJ֠),fpjmx3 $u%K&1/=O?SuL^,MM{'T>;N-Yf}.n~c;9:0\[|2(Ț6F eCEL̓`s[ZUb5AEy#uZ>-CMm~PԪtn-xgt|$\Gh2X'&m#Tvc @h=<d6?jm= |CbZ_,z=R/p\:Dvέ څIH88GB/q]oʗf[DsrB3_||C-!Ly/0 =@jAQ£1Gۏ>(ű4֫*+[}ٮ\NR2uJ*ziIPrR"b8jqMp'RJn. c-0cߦN^x߃_.[&zXK7[YN8wEuvU)r<n#%5=`ߩLH^=G1hԠ̮VtxJ亥K]J&HdyfN[NB@V`}B\~p3[bX5r.  n'I`MZ`VǗ3 &r]x$FFBW;Sb[L(C|6lkSa CX+0G.l(xa0ڒ.V2M02mn0HDIoEG[mU.|Iq|%}ar̹B\&A T^WFK$yА숽Ru7J]c= RN̢?uOAܻM}%S[* T0yK}DčٱKTٓ XXXJܴhVR=?˟-slMY0+5 f7?1D r-:A[\ 5|3Gt?"'uJVgL@Ey#R1$7u0@\B|i CM@,Wl [T_G!"= m"u%e&dF]KXv[<䆱#@G(vYB[ɱ[ ;y˶LɜMB\hL#3&8lrChؙ#§B)&x4{IXh,y6DHN\79yHx5}{!{O7*P0Eoy} '{/x<[o=o'KFJ :IZ:7rh= $g'@80x+.ɮ uL ZïO7vx1[r1,IXk, %J,@h c (M<l]wzW7U* Amp p7M7=OW*odتr;c'8ǃD Z@ћLwWyux^9YX,2c}!_~>fL UG\[8QJ%a3S;JhI.D0ZMnøNٕ6~~i!ANsKbAi4ksN+o'Uo=Y"1 Ns/Ɏ5|Jj'4Qw .a}'̈-6@zwV9iK7V&w@-ܷС1V_$"/0~$n9}rt{Wb'%QΔa~OЫIGqbTWm$xYɿRK\+U]s'@p1L^o͠=%%iӆ =}gٓKsJi+ӗb}&G#Yr&Vn 7|tX߆ΌΗ5:KۑB[M}a{IKT*jJi h]:]ɧkD1sJJ71IJ[1iё7OƎ!_S$z-EZHyn\';/Omg! y)*4?'~F -'94_HbNOamq~RNۯzRJ>m3/3ѠzI.03}OWagǤ僦{(/MA8&D[2Ў?7:l>&1 \#uX)Smzѐ:Mh:dR!eLLS+{} |XG[@ TVb1%'`|H L 75άy'~? 3w?Q?n-8 0J#^+e7_L?fkbH'!+(Ex lA`P/QۅXD/Lv]g;.GyKh 6Ny 1Cآ5eعI9`dd$- krQ5ʬAi@ng@XT}W?/5(:rMũ1Yq;>z{).gC{J8ؼ.UcB.9v+ZoE47F'O) 1)V,<*$O|d'w:^mg^=ѺC]gg'POM6!A$wUAD''.ᰎS',Ɏ ?M{ȢWl9f_l<^zSqɁ(vא:*{| eNsB+YS%}61ɯʄ{oA}F G,x?OQ@@^m _]Z\зphDOTo7Z yi woӺќ[.!~h2$֓;-!So@Pw^iXSoɑH;mrS2F9)~aQn?!)rt/ z[]Z$j+dm\R?SOT)| n7ePVVș6zo kŠ]77yXyLL]a7T`\c|&n!(z_Y$ (r;#D<]my(VRnsd=muAJs9K#<3N|Yd x|A0s~_H u턨XFփȮ$_iv[*%X$AĠ185!c(2_h?,PYTi)#q\ύJvdWC^]R>S.s˙L(>-ⶡC Kms o5C̤&U,8D'*]Uk759S+[R G V.AkۉͿvG,S9늒Nf#͜YÃ;V=k>O_(Fu?3soX>Qq)HmHv BsoR ]n4c`/VC&uY(];@vK~L Ie_\l=|EFo>QgAL^=hhDNi)Y$jFS`v)̏0$rD,Ͷ|-OI-(:'vmLC} ^rx2#PhyB Ԛ8- Ɯm@K59~;^T|qG)[Q][uTr%Әz+g9:` K>-'H=O1s_ZTOo5"w[9F|~)Y]ˊϔΑ3|Aw8QMzIF+xj7kWSP_ ΖcN- ˂;1%=7 'D؞0j OE)P.ֺmiTqN nqvG6>BhKMh$%j5~,Qrp+1}W˥RDRbf5V$ɗ{i2aS"", b3GЏ}-ļɔ7ٍM09`8e.SgAl֦N3~6ᓻ`g5+_Izd;zbgmL7S +jzۇ flYg;~40Ks<Y+b%tH|Nd \4sGD+*ٴ\YA\w`R9]8yrGʎ$̸uؗYm[Ǻϙ K,ڃ|O_˕NP(M1*OôY+aʇ#@~p'^/~ʺn&-a3 &惧]#0YW ^^9AٕН.ګsv"# M-R[^%ENs- 6lPjRG6AjIH}[){nKxzL s0vNɚzew,ҙiW%b:ݥ6|RJs:WsӤ]#<-%97%GكA`rT1ʓdcԝ.W'>x$ shIɳcz$(|cVJ9l=GGSd@BuSA` Ē:g(YQvf)a32&cq m۬.#!u.R*PTCV #L6[aݫKߩ/%%Tq#{/w ,m!J`tV؂2M ,s=Bug͜ ^gЕO9A\TD@b]>0Y39tË`z'w'Kw^ 0 F# M[TH}FI UT:W(>5eD&?wĨ_/fDN 78FJ<ٳv, N H~~}jyIƤgqF#FLj~6@`dPeةU(LRoj|(ahs)m_u$%B y]'g([6Or+ B6sgj>'e`g }HV6Gȗ)Z&a [1r쑢&w/]*&Sr5raOƏ8;O\6$8<$@>]rb4 7n9mgJ}Sv6XYNDqī9 PSd[tuI_%=ĐAL;7Km9TOc i KC31j1DǶJ%hZM[ĝO+byrcԉ7>\+n>@ }Tl[rsaJvBR율5Jnq1qbȃۓFq ~\RԼfXc@KeeC+ifʙ>w-53sʗα@@ )شQƶ3q~ښRB#ΫrG!L^תy-&IKt ?jQ#P NO{؉3#$OiYKs`&Akqzx5Xt;lM!:۠l"5Z8ݶ7m'"7OzLQhA9Ȟ<~7$'3>)DX9h7HI눛\+{ <8е0|z&~YT,s^dԳ<VEHnwJԧ9)um+ ~ ГXG47ȝLc71Dxbjn,:ędK4(;{ Mr"W`ӶG8&QAN2>b5{)Up\xk|Hx0ϳ6iy`n^ѶgJkʁJ1:o0_ ~+LM-F[2,ӰYUMijj筧"$Q'8WFFYJ_1s8t`L]WchTIn9UV^κ?'IvҼsD{}yJF iJ뺧*UyHX 6n}K25L M[ɬiBD;dNmӀv܂?~g" }#h|-ev! T{8Au54wAI[;-+i'ZMl|󋾸͟'͖Mf¾>M˕H4tuiI8z$Rom )" =Zސ͠+ԓɅ ؠyWIm)<#q2K~ePѨ'Rfূ-HvDbq>KUZ\w~Q)'rt\| o)|iuirSnN+oRr@= ^t=Qo)6RgH6=Deϝ{ X7-ˮkWc N0 LN3~4Lby^̃i9yS2٣qu9&=+ S Vo)k1Mn`(/lV!FB>iTW=m6ilKEfBcJ3{p/%Ú'b]:k'))B|f)rZmL`mց?)_fF^].=:8  5_Ra׶C s8x;7B<:@۫essM @_>ʾ\^$//{02qmY2,IzKn@;ߔlŪD25r+\qb9hLj~S58j'  >QGRn0) yOfFڪIKUL^`kk0T0Hst zY4кqqOne-O/]5Ekk}6u6XZ}%s9=SLB7:hIq.y@[3@[rhxYG !j6`2O'.jXB,:e&!$ Gi1NHBZ0=\i N1޹]#*;㛼m\ Yۍx2@洛Ѱ]vRZ"5r8N3v|INcYW V^ aC t$Xtvl xQ_ [?X9>(r-~6e RTs{6XlP2_F6EEt>2}/;P2_[9`Y>S$79]2t\:>Gr(g.\LWYTm+JC5{ik^R^شyhhQKsEzѭ\br/`DoŲgio_d<=A{WVgMFܾ7a/\$uP^^1leN,'g?ۣHRl޸?@?/bW풫B@"n$mE>s'j%yOSJ+OMcH K$i '//X ꦾڪY#k^qmh ɎA矺^~pcaxIA-j+2,\L}'#?/Mm{֜{aWlls5yN ZPe%$'`wN>6 S,|\DE -/zcS>M`):|E0ق(=;^86jG/;@KϿ/cXюiG|;HM[n5 ɐ@w5]mW!'j@È+g'sJVN_ڕˈF]S@*& 'بlw;|)MRqީ >sMp+nh{{O]w+d=2%F0Ϲ~Ӣ[JOof'=4 ujlbʐbT0cXnUGʙ0sⷐLwWv~%&d>ilF7qBRgԪ u@ oYG(W2Eq"3W% .M_;'EaA.܃~VL}bgk:z&/v/:`:{)}|,.%< D >n8e:P9y H93OqǴ̱7`X4۸MF03&ҎY[LIN:l\$GcmnX d\IIGao 'ez`..v+Ǽ3dmMY?(yM"d& rĝGTIGl Y( fX29?BuY)`Eۮ6e:D &GB{"$ O khkzAAKww+&r,L WͳMsw2#n$gq«dlԥSZBJl=fms?4ap;@ŸUKZK{9.駏 |SX^} +[Nv1]ϒ{nyw)\8mblLmyr1Xh\m~R(^vlc7z`ҘƌL`. ,$b%.QRǞ̈8'J/'O<?~_ur. &E9r`?;(-XC662>:u.&tӣׂ1G- jIhEևdK8N|1\D?۲ LrZ :))qIbY YYnBm( krY{T6DL%! -o_O:p=5[h&PM5ڋXnfEv^B{v_Քl JB0qB&^Hh&UmHRV2_x IXwO /GD~zD߱S]PFlü c n62 mZ~n-P2u;M*|sReZ=O9C+H= ޠA3dvp?pbm|>Sœ@q@v]Ĕg:_+@#`H~LŜzBvEiX?AZQ>˅mV|?3+B-]*k*wEi >-RU !q-C[0`:9tI DJ? S(IU:=[0__ĸg?ibO?9¶t*q7S`OOY=X^hd3r>6ؒUR<鱜 *3j'jP\2i'Tf9%<ܦjdVS@έ8*$fPMoW r H:7!RJR# j\SnL;͓ju jw|'2Pe3k' ЕEo$1rzOOa@?"DhH%<>:`+CIɔ_6x'9\)(Z. 3jW &*F49~eǠ7$F˜N)/.:I_v/r~yǞjG-WqI967].㙝<]-ZE®]<8|oS#:w7p}<-Hiy<ķ q&oʴgzʦbygJV ֻ.0wx3eeO!l u6<ŪuщQ܏5t; ng^!+g̦34[;zYՠB[Mjw*$lAHL +AϲX|[YyYSo.|@4B@ˣHHz)IZϟo5k7 yP))ӓFƓ*/4ʾA~tOv|tյxwAm5׎m*DO:w8ɳ _`+ASEI\5$o7'v76v#=ߓiPL I9Վrkj!Gnmi)ЕHi9Hm]EޥP,֑႒tbj*X=~p/y3FZK./TG3{:m9s9y:DRlt[a3#?m~A iţZj?/Uoۗ(GD%26Wd^'SWw0 f:H?KCԸuMTQ3SY-Qr~f7tz\(15@d7XMLN+: +f#}z7F#VѾ]$ zrJu-"[[wj^EIedh-`O7:VƴH_,V!cSQz&FO9sBZg`%pF bҘsX(dj_L2^0I-LY!Y"F'%˚AqeTsTV<+{%B^8u-t]e&ۡG]В%:0qU+|g?L~oZ r ў #in cyRf>)3 45)fv9l$^HJJ3v E mi-b\5qba/k֯N-G#(H1hҶ?sʌ_v #4f",/| c3w*9Ҥ&˼+*+)SV(61n Kr(s'ʝ4 X )Xv55YRnݗjw` r~yTM7p$M3*kq'HS 7JPOXО>aO&F$H9MWS 4-ye|v)~ uUIbM-,#fc?7@6N29W\ZJP=SH 5JI6H'"rh7iePUn'sz+5kQ\* 8sc?z$k5\`w&NGBIS BScb W_2To,wH'2.SXuS>p|W[ˎwS@t&uS%)2s;~f]t65 ْ~b+; ]@/q ܛY7n#u5ɊB+fg!o'Κ.0#@<6 z-d˩^?7 WzR;0X? 3k`*}y5 \ѿQ h~%R~gI#69 $=R: ֡L\ CT]˻_lE٢2&U+׿\-sS^Ň^0)7ż i&fU2a.xTgZ߸|3YW@庝Rϻ(0Kw1&W$ϨOьS\Jqi-uʓaf(X> 7n T_?v"Pʑ#򝃦QO!,x)pa4brE9VӮb)FU0Ƙ&NOox #לE$6ȫ2VMB{0uTLÛTn7jt+fQ~ѯsP$LMuyv2`m>asΞkAbj꾃'iQH).MO…ODVIOdM_h^8sdi cڧLQpنI=֩J ;1z~qmЕupD.׍rC53 މ04^KI wZbN$\bH%(6 F #N略4NP U^ejuh'$*XjKdte>b1H \2qIٹyK/X=Zj`(T䭅S1xgMLE珒i|`_8fV7)jfpAr\&U.ϢArycމϙ6F %Y^,pm~ۄn_TL讷5Z%S*baG vg{R>-O}mM=0H#S cYfc3Ct'L+p;R'Ǥ65~LQ]4-j蕪Nm=9&DA04lG>{$ωsIzʽvTA&f]\:dCEM}Pa.V'I2ѦY ZuW$ز=!>Ū?;tw["A\ <9{JTa>rIk9hZhT}jhc\,%,SW JUpXv[>gы=4ryƅK`={cZy%%+Dؗeq*dTs4:q@k=U녹lb}ђ@Kۄ@(f@ÍP~+[knyQ*6fKbiQRr,jڶ?Xq(ǕVA<ҳ "yrWt` _ Tt)g*|hwםR/`bI>i/O5'>_1}A:o+錵;55ƒ۬&iX$f(/Sf V_RϔX.jW( :)ܫ<V<)؊mlV:'m坖܁8 K}γI׃"mmsS^4(o-@_v3yǜVqc{|oPA-TGjtY{/&0޼r ^m?mur(պN}`fL3Wz %︕%!0²J-$g:]4-OR朱OɕHi;:{nSB7!tnd|qjsm- VltYV;qr{yMG58N7ɀul:‚qg͛kO+BJq.3^!=@{PU*f$EdM=0gDMdmgb a[.K&:Ry*&}:$9~ÞJjP!h?MBp%g4w?\!4q h/U;2ܕ#IFK#,vd+VV|;րD @ύ޲LkJYAZUz}ݶsp(xyoGP˸1d0L(/}?3|瀋MS%|t?-f7.\)~gf/*)tϔ1?:(j^Fֿ_9s<3& N[erb?F='>;?yD% Җՠdgf9# 3ڠ<(m:f8Z<`GYWGyuSjF9B m:/B԰7 ֿv ݼ&0 !O[MW$S DupȍsAAk sN\l'<(v&W\0ΏWuC&KG߳((v:r8sZ4[z*@gyV,Jj@JNzM 0{;Rڕ~A 5X yځ&=3M:@B0@g<&vxާõD CsC*#u7 )|spSHi:)ǑCwޞ,G: JeoL_ O˛ Fp|#6R}քj:^X!?ܥ6ۯڠ|Ui*fܷ9FOMsBzcM{V{ PqĊ*aMJ(df)KШ9B0R 5QzX+܀K@uvw R(dcM:S|\]fNhO[(yoǙAټVN6.Eq r4MYU֍Եi?k$zs.ӣISD*";Utef[@h%ޜi/&5v3!vk-& \&(Bt:AN"}# DYuɣ•(ÃTld)3tۗ}io|#r|SkRl =]q~DT 7NBn̘WaƧ B!X/)ۥ[Tf;VorfCtHqs}f 'z6I%XnUx'hݨ+ng  -e¯&՗ ڙ9R[O.S mSi IdR7)OA9قz)YӼԯoMyPĂ0&[ʸN,Oi% D[aG3O ڽdgMLE<# ))wAN9uݤC QIMXNfM{]} &em*'h(qߩ&wnH&{M%LX>Hjќ71-!G콪gpbx-r`FFRm@;a.=hYdhghj#ƺO;9|'*i79?Shw,<5U /ΘXtwmfryk\Ҷ}I~xOɻΫF.9C'j:ѧU˝$auKq ~-cRH0f+57wq&%S&bQ{*ζ^{GgS!+əܡTF+mFFqJBaB ѝzԔy3)ŰgU\6ahpQ:sg5TJՋ؟k5O"M"elߦݒ[#ے@asJMnkw缊crȩM/'Pܿ 09nS= ט@1!j$nLK n[܀_tF>^KO^£ٿ\7y%=Ȇøs*`-v,њH&mlXLg`9w(W~#J+{M[AL׮f{Yp+>^&'7?!]ɘkR]w!3YdɛG˺U2D@Lױ ֹpJ B6b J`f(y ܧMD_RA DAJu Μ7Vb(Hfid2Fr`C\ B?]p2lAf/[ >6Sm<:ۓc_A e =?md082^u?RE^H~>Y"! )pU㐘>9~Ztn>˯N?괁 h;lr }ն-@,f4Mř!|qIbw38otZ3u2sr?z,[SSqpT@p46T>TR"?cx`a;ùsϞCA> 'I:ѻ+ם\dbLJOEߓ}"gD'F#sOAE F%SZ Z_N4/w.--[Sc.:N{з]1x糔7]wܼ\~X m`8ᙸOIfG#mͰ:'d0N[7+i*+?FMGȶUd'xN߅cْW ו2Lӓv98ģ3`W^g+lQ~bQ#a87o B+__ ;-|I3T^^AWsqL%#IkizSn(bI%s:?+e_ͅ\.q-o@ d`}J/]Ms [%)j%CӺaN_Z!Kp'y QuЯ깙~z[]GUL{w9qv U3,|A$ޜnM݁N:I @镃5l('+:WG<&pVFfICK5mٔ\O1+T B /^9yGYH?яC#KnZ7n(Rz-G)% {J̉w^\\eh,:8(#,d^)g*%-G&d,ɖ4"eI~K%8yP!ց *#GBqNIk躼U74XmDEtM6h!ՀG \h]IJ>e"d 4Lfc>1ǴW坧2%dPNSϪ9ڑѧ{g/? m%@$W9LoۑbY¯(gv֏?lk> 3JAI\) MQHHzPѦn bo?sqrsU|!'Zl[q3k ) ;uAժwẓ o!L:V.e>ٴA䖒zl^¶60al ?*&4|3rϧF+4 $'* QWvwNɲGɆʎ8G*f2$xp Lm+\MvOs^Ws>Ćô30Ikk}Ƌ )T+~w)Fi4Q5]y'䵦NNϋ Ӫ~~lzSKln{M;.65BJ?_- F+sC](ْٞJE+R'eEAئ=+8F~G})f 'j&6yiuƟ9;$1F>*RRB=JFNbr)sUG3G)~+S9W'e7oC#17.Wq*Zet})|}M|NUNe(5HR KUK0=G-c./UAHW|O.Wo'Lcz3'9{粇Ʋ-)p{t`QQ>wbJx$V? nmv2XM}'e꺽UZTRO&,{ q)[?Ղ5gc[or^ִ]SĔ (A6&L"Ee07OVB8nͳρǦ $7eBX1.Q0=/*tqj?fd:rk 9,>Vt,(#'m Eɉۦn*Ew?t{qh=Y=ˉ ~)7.k!2h܌ƱT1o1ŭ~[73O r*ĘL%>R5[cAߌny4&1eSJhsƹWX^bBwcG? Hi2ĵzUN\t6#+L7U[SSkr DY-Wmlͫ%E-^a !.3$WB&8|kG;dn젰J$Q`D>A=%sHa+=$`7Zy/6oU:|H_6 jSW?ُɲM8yNc) f*%,mv!|[_\R3%,LT7Olwrs 盂iA,1E o+Pq,"=x;閴llH +\1%(%lqHS?e(u; dAGYd}R 4rRM0<,j %הk{ȠXWsŪMQ n'd{1kwPE# x)cEWf>"P"i>i#~xhʂ0߭aw|;40,m1$FpKB>֑6p'!8t>&.!4~LaO6s" ;+٤ @z$Ցҫ FA@B*LQXjY"&-9!-גhW"UM᰽Ks@NϏ;1KMLN|mjA^  4LS}$sW &@^E]W|%%aElzuY5`B6` Yy(E˗H|claNE-AqC4?y [X*h~0Jt5uL]ᇖlޕI' ^sTZdsLfwf=j\ V{FtYECijY(JM-Kc$:'m߯T ۑyk^t)6 Sw&fIPKVqYxt7m/zҕsVIWj /m BE tT-c`j6N%ŕ-pnQ2e@9X[9M5&8=qf ֗씄"mG76N9RفY]NǝZIv#k)Eç*%k-HC'N}w *d5D<1 Z L,22?\ࡠleBsy&D:j~BgU}Ԕn 2s@>م7@Qq q09tf}I_qYk$ p|I/c2ZK2A(xg{n'uT MN}m=༳+m5zx9ͫT%'ɲtgp9wʖr%DZ/Ha2`y*_2V2Dg+udJCy9%W&5\'MD ifH=@KuDŽRܺyiIS2dJ&Zyh&ho<ĭ L=Esl|PJs~9y%B WjT}}N;z@KKJHțȩOE#:"YzX3/"6j>nLʢA˯y=]B9̙_%кsÚ0'ɠ)c؃ RXozhoOe7+$|5+T1@yڽ {F|RK  |Ou-&WN#]>qBxlwRoMMp|K;Q ґ~c^ƥ%We-r۝`@9Qx.fO3NUJjlQ9?I)jv>T K TA3N.gG~_πX\ȃ]V\<4% @\ejzd6qYE`kWb?5X0x%"|?^G^=I ;u|1 YU/계yXoDvA%@بkYc<.8&hklȝ #t">0'S,*u}1pH0 Ҍ^biMaTQW=CWb.@} E/ >|;Y4;tgnC"ѱjy.3A)V&tSVY'kIYN:}0?+U_#B|{oj`f &vOum!W.@& {p兯7k [Q5KYecWú)#Nb6*v©[KU ks|7UmMoalt쎔5yn)$|ҩ- lL0.'(Oz}prCq8/:Iu7ڞ: shT*+O'&ٯmLO9a3=px$bش4vNƜ:-8LN_nW͙q+-]xX&pdkPGQ]3ݓDs\li2րz.TL*{ݞ (~K$9Fmh,$DNH)9it[Jt)Gvgs a4~}f͌֜~Rj*Wi&Xp˴FވE+DCkړ{脦(HhזG.ӒI gizǾ!OWAMjg!@y!n3)lKFM'gl2/1c_Ife+?2ϋzn8I~Ffbcç\T\r)Muߒ#1 ΢Cw(HPo{oLW|:LӱtÞ=x-n2)' rֹh^/Me?. vye)w2C Cp9zLR!؇#4IrXH/w+{Z,rccƨJa#CI/>}4i9z!v\S-#0 Þ$rn s8='_{0l?T6cNbxV0fL['m.v2!l11핎{ޤ47O?X@5RLnV\4ٲ> 63"E5@9aUz/y;AE?K ydU {XfHE}A69ORM= TBX8H)녻 ښ-Yɜs;'mي2D.ZYI*(Z-Lږœ> lF;[xHJ%=*a³ 7>T]tph\3;DĚ,O{O%ɭ.#%AGnVPE=(h{0a/y8^I<`As]D rvvM -Er~>Wi(zk,.&U.l O{$wq;ǧ?7^H֍GJ!$٭8XLG@n렜 0e1D;_n#3_kV;Cꠛ$g&[JҩX2V sh>f:VLM''`0S^\ܘط\ؽ|Jmq¶'Zd-Uiiq bL}iL]<׶лe$CH} Ǟl9ȏk`]RJSk;Y ΩK2k<ױ<)Ft +Y"}Ӝ-qTF.GPv6vXMg}EuR 0 %BG J #3Wڕ%ey}opaԇ6c KN+?&q!IJ8*;/fnqCӛĞ=6@s ,씭qj6S8,}π7F_ W]36ܟ\Vezvfj?z5-MUQYM.?]!XYQTKɄE2,mP3LI'wDr)*\Τz|M6|A\LbL r&%峍؁J>(P#=le>4 W`]Sn^xL+p!bEQ>F3$d9\t:9z)54yR7_Խ@Zet3Ly7yTH4Ɉ!m\c>*ϴX^7N\e}iޔ[q/B5S;ߑ=y!S06~/nI~&a'Z?t&M.y`7/ ryKك̫<_MxdLDzc{RLM,؋ h(},4 lDl Ht~i-8.DX5ZWɄA_:.baZ)ʩA% .y#3}(LCFڒ~EK6P%[֗,aլI} Z\C~LcPk $y)Wi%QIs{u- n|Snu%W֐%4Ry],f֊_2IIes8sQ[L5Tө+@E;hbqXbs%lH&ۙnԩ-bBYة~?y=W\9ˉI?5[V p Χ6LhSNBEw3x[FdA[;l[Ɣ*@'+E/dd9UśR,{rJr9}7CÂ3Nf'xbB3\OCj$?P[۔M7Y"؂ӑj4BvDjc5QFpmW/F8,I!|  ٲ?5 Q*cېn \| [}w6Rhg‘GC_S7=;\s%ÙJNʋ㕺E,$U]7Zw /l&搐ͱtjb_a\wc|n =}&U2CNw9Z.kߟOkV -y3tMrْ_mLׄ;KЀ0wg'3J{twCKN9?ͭ?)==>aEe<9]5}ZiߒpZrPvEn>1E^\ ݠ`s˒z$)lInYԔ r{DƇ+5&K@\}80%A 1TƽV {8&v'J:^E\ԑWazP =$q%"Zgy̧vzF#Wo$#@Oz~|k%l~N8edN;mqI)+Ӎb97TEs\  Eb)l#'~O6A"MNy7' ZNfS z$~˻,wX[͟mGpRT.$8C@"xxUZuG^b@־[,u 6Ώw ML^e`HI6۟Qof/>SvTscyXͭH:mb Z\zb.ז,`I{= `uoRo-{Tu?Jw~"KdJf]”`95yO& ճ66ZMnj̏y)(t_n]N6l< c\ND@aL\>|/ǒFO:v$!)鉞VҎ9hZ%O" ĩ2-"q2a#XE?Z`w5q 9kIu)٢~l~ȃR6.'Gc|wimvlܖGyw7XQ|HYEI;YGX3ѧ~~s٫|zQ0ݙ}H3!Gj 87Dd3?7#hꋼ$AQ>)z8?cw~[uCFyENq`Gzk-;E O$|sYWe*Zn%luQTN4TWnH ǝ/C-]W&,}&A3a~[ 5m|dbs\'";5'=TIj*1B:^ujh%F>rT7eCRKQL6_V93D2+sZw{I+|'=v:(oW I}8/~*JkO~鄱 K{깼 @ӠPƍ+Ҟ$薰{ֿM{dbQ͵z+{\l?Pcr1eNgbn6 IͶ|ʃ*O(O2˫}e 8v 7_,#飕э4[y3 lצ<C Ms{ʃ""E#fs,ܹ<+_ۖ7}T/:q^ӂ4ȲG{^K9E:Gٸ*9++9E*5soJC/3 D{PR^`nŴ?1f'o}*8퉈 䭐G/4h1"SII)МXߧ9@?8WiU.M(UL yf*Ry;%~ׅknS9y'~`31vlX0, 8K:9%I޹EzMbj{o›9!:*7'WX!` g$ˇNd\SrC<Rp2XV%3c?*@9C"r7~"̄H>Nj*@x:VRx+vzyA՛ơ|\ J?˵kdh2,W;왂2e9䥎&FKs>54 i+ctZ5W!LtF?gwKbZHa 6)S%Ij2ס:nLu2HiXpU茝ϵ`\>Klb w=M|l)MDR7AeOlNc#ŕt~b}`Sc7Zho íNVCYU7\d:59KQv)]DCkK,$'^5=&bEk5xo m%ױ֔&uS%wU\0z85dDNٛ>PPJT-wB?X {Wz" !-buiw/Iuw$ongU:r g;oFlk&Wy5sAYI\`@՜̕_b_lM4a[1œbzlyWEm|ѳK^ؑ;t6l,S 5<#Ici1X C޹VYl:oׅ]8bVA*O@orh##ʅ8]@N5(1+y _"awH(/9;$Dܜ@9om}ց5_-DM /(rs)!;9@8vK ڛ.GG.|Önc\ .-6jmmV*03RY5M ;Y9OzXL!$\FENR=m*+p E~1ƅNۨ|+5_jfgRgtB9]|bfA=˒QChsHjt=(7}drqY_n ژ6 k}eaq`.P!!?<\ŀs;Q+%)<>kiV'>{:yr,/^(kՄTχ0T)]!PiXCNW\fcl(1_[+2 y렉(jtonoB'S$R쾝u}k:ڹqM0(~ 7dER G#6)⮗"̣NC~TK`3prLEp{27yx&:cͳHD;NxĄa{ͤ5l`v.,XqIhl{wν~,pCr O],JPȏɅ*[zPW3[E|3m83qي@*3i9ff|DU_T83#H1Ŧϕ:f ҷt #츗I[0]/xgU')\bnVz./ړՍȠXG`e"bDR>|vǡ@n:~u_EykoOnj/uJR/qvzE\yJTOJ(0 -A/`8-L&oE{׵W*_Q fC~K>l afӗ֖9u2wFOߦ߇M91\JI&3qwS{K <e#@ޛw0TFT+]s[,)&鞛n4~?:'LknX헟x"`\W?q}BolN] &}6LvXxjFpy WCbPMw0^9~ .-N\*1fDf(|&ENͣ ٚ:W@ϹD[f^a~=Ό٩Ep_er c /z}kLqN$e{w#e̓['-Ap />ZPvB7- oj'cΐm՜Ү JK¡a`OqHuo΅.7%;Þ*WD3RmmAf~PJReߕ8yC2II喳hjfd2mn|`i[‰yuښ[zw)vN}Ibn޽ĆJeuHZ̷;ǐB9Fuu? <ޗI#vN<ÿr&m~4xRYBCg9LI%S`=tȏ+;q^^J-yN xa+0j孇~.HFQ0ׇY6|[u2McJj7EAȲľ?h\Ey<@Tc'|y4),Կo^[cn=Uu@9g2#'2G4jm%cLsX㱀ݣz[!]0?^`keܽ*~-7yؗ=%C`!z)}c?<T5\M &tku1a%χ}iCEWg#a<#  z5/a`A1̿͗^ޅ9_%&s&6j)ZXILaC}=^Iz1f9kIvR?g e=ƿ[nXNJ셛O<\גR~?)9t=YF2`O{-yvS9kUMIG$''wMC>>/!l5;GFgI*0 H,9;x-46!䚺N' kSK4l!&S ^N_SF@|&[\˦&f%j7D?t×/ST ;q=.衱:QS?dBTϜ6LWJGzZu=疶t c;FzԏTΟ"AGr1^uɏkd{lAdli+`m u!~Z\ѭ')n\dyڧ#V Fr8n/IS)[NTYQ8'>5eBcP4ynО[1+Hёtg:wˋX,MyTyH>uznGk|rN1x1O*tY vԌt<dQ HڍGb7, Ga?7GU˲;+t9aMtp{(HA #Z56*-W-_k9w:9OvZ2=ZT ‡Z~b18^y/m~~$Y$qӺ׀b͍M-i>qlB:@gЋ kP9ܐX&,ߟ7z_2)uN 2;@9I G(+i;Hg!Z态dvcNQNJ ݦ)ʜ\5HVPe\d(YwPC#tdlIh ι>ȕz2tϺb0ezf4Jc| axV! rjH] : Z.">LtB CqI~s;c:> ?B]v^ҪbuHV]lJ w-&fp[dWJ$?kJ`6oK[Ubni~Mv䀩?yZ KBa{1^$x/7^$h' b6(a2,p织9''(#mSh\hYs~~[N+b׻> vPjl \K#ۓݩ lrVW]hsۆMuuc3J0SSqi]׸`J=@мsOj`W~Z'я>Z^wCCZ@ |ڧFM`OϽ7g1OQm ` ٔ9 KU8A,Df: E̓S6I|[SKf7G=S>òY jOӫcGohIş$4n}5[RRR^ls0h}SVTkK nacj`3dY.OlVqVP^_q9t]F#q* *KQYrY2>$!.ԯSngl\[$|EQKIyАD^i/ؘ s?\kBN糩6 `E?ʂT>E\K ^zo*!5x|){*s4ϗvЍB$LP)0C7:rXFv5Hֹ]{}6us-BЄ&y CE>e)QGBțuN{^'?#a h d 8wh' @{qF{Wk 3VY{@[)}Ѵo/'/"Bsp.ywBJ`5=bP'{O\F.,(/rXW[B?vͫ`bD3K͢rxl5` b\ߤV0)z*˿Xv=}nh+dfd`:h3Yv w*gy -wuRqIBvX&4EN dfT`JNFkz :p9W9ݴk)c TVi;Z49!XLY)a&%ҺRؔeug(OhۂӪC.[pUߐ%"c@$ ظAcQ,<@]Ob͎E` $٧Z}Q׃t%.EB=2h G-_5S**$>悳zlՎ#  `{\8. (A"Ӭq#%]f)0)AI6#]0DHkY1(P$9>8V{Ed ူO?`{s{tI8@Zɜj> j:Fsz{O 6i7^X1Z] iTbn["lڡs&>9FMjp?lr?eyZc&!&&+I4hJY|]=H-ji9Wyr|0ly}զy{NrAV՚\.yc M)&]תmc{|\̈́MeJ ńYuNi8_>(F'_F 9G-z}L9~sƒggR ғG'cJP &G(äy-@ER |C$| J2gnG1N,>DW~:qO{|φ}bKID:XWQ:z}S_ o=_(sT nČ5H R}j?/F~뒤$x*Wgiy ,w?t~>Xqzns={/~Zϩ'zN@2P7qLփj:˝_*mY(hrwРpHCCQ3y=2HpӰ&߅s-F%Rm\#j E%?m$EabMçoi>!) ^FO xG{&~[ZV _Jyީ[0ƶ'uxɋIVP5.u+m@E&i}ArK -CM.C Q 혬(҄|[]/3O g;bD㿂%w&%pxko0PP$<^r9h'\?υٍ3%v2w^d>tL=a/(ŚOHZhPO-$p![ ered){Y-Eos9hw'vREՐc:,Q9ImJ\;1=! kQ^"-Ye*zV'y$>e yb',y*2Fn$ol2&E&6aq |P\϶͕Ӭ+Aݜ3KaSL%Ӆ%:c4Eh_% :}>"\<8/ $JMXts/dT(2hVn=RO/1p09Il&2vdֽJҊVi66)MHԯS=_%8lhqskcQ$-SbPja$v]&U9hSR" fW yO9+)t&]prOoфTBw9t+4S-lnf,7 1rx#=#݅čL7M@--AZ5./Bܾĝa4L|L $I ah˒6?N/I՛Y\8l7uЪ#n~\$\Y"侐̕/vi%2r1*Sez_+jN"mƸe& Qd𚈗R; ͦ#KY:> gRoXNpe/*Gtje5x$[o3A#*R=06ƴS[$Jp-I%jK.\'矴 z)h)>ؼ7w- GX@܆^s3['o[XүݲՄi;aUM'zo8D u +.~7 tDRw ѕ{Z9 ʵã%?%hZ/vs~oN6KAik*Pg1.D*UV~Ic pa`T9lrXiP 6I:qQRBW>!`7elx|-ƺ3XLf>5~7kmfn^^Rj+2fA3 3A"=]'&*˜oao4/)u#|ti͇7K,U\ b2m|v%"wXI_Sxc7>5xMd@B:Ba||@|-@d_9!9}#IW9 Iz$z@ 1}sN)bw2dHpFr0NOÄRkJ;.1^&Єm)O:\Ny ׫UҢ}ϡ2 $SAQ;zlّɿ%PaoyH$&SR_7}LU8O|byNb=&Xl I0~ x# O*nV^UjJoŽ_*4i;#SM4&5_9[)!?&scњ(F|-ř%_)܄N8&sJ<#U`Kƕw69̗7K=RehO xz˴&=׶LQ|'-Lyt<@ȳ3TkŸIۉcMeqV"<1x4`Jo,d/|\ER\H eꜫR[sKؘܙh=RLΌl3JO&O[ fX\t&k|9e)>$uA شOK'H@`,@7ٸ<%ȕhRY/PR>⛌`PIx֕~פ-e,XL!ԭXdNlkS͢eϕPrn)p%.t7}$.UmMډ$)b 0vYm\4Y;5)o `Ed+jM!nSNaQ{ظ~6liז,YHmЗ;Lؙɩ_U =~KڎE_}xjk筓1^,=%q`bl-_ 9,!GٻY 9ߔĢl?|S G°,ZhuN- -؀sm ܶߕi8wc =يmv<=Hrr$d|n2A0ĸMF0o"s4oV7'u,ϒrryIoh0$'zSeʎ^ЁGCrdƚp\M$|9b|aνt +0ѪfP6rɽ]kdFӌaƕnz%fdNhO|[gQJ?!̊6!乙shDeCk c=/%i˙NO4kWT/ M͇ՊyYL3ߤʃ@Zaa1N1Gf us_{JJi0?ѧ&v`H~!rHEy;YB+FWn/<$W>iK؁+NK8|LKO:J*pdȟ6 SftxY"a\! si6:? eͅIϧ}ӳ+OJ雟88Q ɜ"8z%`IΆw[:r ɧbH9.n[<)0KM5K`PA1=Ef/˼? 9}?#N(DK9lJI%%'!+ʗH>ziC,?n c$SXvUKȀ9Gb7}w0Ysvv',\g>4Y k#G{ǗxD^TkA|'rL'ӑ=w;[*Ҁ`L9]/<E0 *1*n=3#xiYu+^dsW\t0箻]D=(&ރ ptKe}̻.$ݸtz!`c@S/ʔ?-A!oryz]DJ2˩]H|9Ԟz'rhB1Sk:C\\S-50dO y!Ι!a4*u ))D [B>}MHFk,[6Dr(9|N8=s1<șQBՔ6ɝ>+@7uJeTGy;%LuoؘOtIM2]ᓲSOݹsJvk%fj ݇X&H#?K$TG Y,WNɾ43>kj!XAg$۸Ŧ%J'o'J~C֮oU!₯ yI3H&Iܚ;HKKxMB;,?  '-U]@BBr*'zgg}3:+t]&zdTc8%}dEKmePA[7e$kXO [ww2U[S ! f*2ҥo^;Ky,Lr͉$/Umn(eMqxi\L1d]Vrt} D;עM:׉a{!t-΁H˕x`<9&^ ))32:䇾՝k×~] _.So<5>ZBʒ&!ڏ'CAHȿy xc!mBYYme$̡ {]bSSI - )4YEI $'zNC36IDhIpb{i2CNK*Ƀ6KjFh7r VhSՃCOxYǮ5B@Aʯ<ϟz̀}"̛_~ȓ.wV#ivRRY%QaWGO|Wvh|mqTbv4c^Pɾ7;[Ag XGG>M\}㰁N")uO'2ڠwj{&?SE%e tRn٪O#Wc%^ߒuu||nIloF0v xIQh/6ܼؓ7f91%T8 n#OAaB^4m]^VNo"~:NTJχ2 :W >yZWp>NK*Lvfty m qe[*`vFVuzZ"bfCڧ@F;|f)KwYlrmb*6i&O;rS}tE9dCOm\٤R8fPCKIfdhD5Hr;k~JxU<08iyQr<mlQz~of T;V.s4- W'uo h%'. ?"oiGa|?Sҫ^eˏl$9O)<<@L5ɩyў] 9bwo- ~^͆0l805(y/jFqm&1}v3 DOM[BAmΩRL>MރۓrKz[>x*8G*jɑ (ˇi;OuS~VǃAp!We3iP _{w&z~܄-ת%~69Oe@$r=#廨1!p}N}&abg|)yS.Bn§bհ$` ‡G@Yk#5ANP X6($iFEItn`Hi2^ޯO=zs(-AQ(=_a`60#[7~KPsxIoi`lI$45+þ=Qyݟi jΡ7p6|_*:FI^vF +Ng^ޢ:JBy'ڄK{2cav'VKqmUqg"3UAGi Pw㜼d@Dv[ڟifaGCLA0ck2S?p M w:îuyhF$kmߥjIQ ?{ͬ쒙;%/xx-xIE9 uKs;i+L,^} }bSʩ7;:Iq5 ?)* o䕱_ OJ')2~F_Dah2MΓfaX)6aurFSAkSNv.(!b=6be=n0$BJ[<O9,߯Nz+rP bm.:HuFxN W*v[rjSأ?YNe5į/|rԚ6(+.O+AR$B>Aosy G~M͛F\V^}/-v"=Tt%F۝{.^4paϾ$R&AÑϢZST 4`XI8ruZxe2p~=oâWa_N:PG**=:9W5\TĴy5Hb 'l?˒5 j9x5Rn…Bd}$PBj$|bwK^ˢOi헂%I66ܵ\Ǿ~}YXl5$B#hiKY]pБF[7Ȭu怴ɘO/trYdWP9$)P+Xmt L!٪0T|/MI Ϸj<#(\/h)h2!5a/fֳ$۾i1 Uo@ONKh3 %pa)YNm79¼)dFn4{ VۋH6r Mr_M= H7l=͓&$$Ｆ ȧ/caDNx׾f CPf:oMO/ 3n;;ЌԼ|2]&.,?rzs[Bh &3>غ2 M0]`ߝ/]csIrO?: {Zzj@9PFc<+7ı'Xλ:둄?]8c_ɀD{RN0\ ŲYEI#+ha&h5Yy$B(>(2Xx-!{1Ls,F¿N!;`A;c@ vye˅8B:-v6Z)P0VMhʅ749|4 ^h5TI$>3B'2Vy sg[RuKlQsG_SkD.+o %Nnfj`%/kⴳgͻɗ,_p~_<VoSSĖ܉p0cen#{qjL0FMUJdϻ"_dSd$ڳx(Gz@x'[x9aej^Fs?t¤DJ/㔼p)G:~v/yvr#;+fKZI~Pž'#?%}Tyͭ4yh۾z*|Ɏ]}#[%ıNɟ{0@z*T[㕴))3K#D{E]<@&I Sq&N&D}88,Igt;PLzXI)MӈvHIwGS:gŒhu9Fő`- v2_=٦K=XVJͱ'*?AҠwyMJvr6>¸=i8@^Ӏ`O|Uj񟆌-^i=H+jHYˈl}-H;_ةpVg:(akڜcC`)’K>e2Cϗ x1_Jl#<[4˪ <|6s)Nn1̂;eBR3b ũ5tFŽYI3hJ'q;4'ᨳ-tn oABW$B.N $wtf엠Ma"D[*cVW3H1KJ$ġ)KL;roKw! :RՎQg_XfwLcf=% [<iRbsBi9ǁ?ϋ$k}">qfo2T>o>>d{4ϺECb#˴$BmL3bӴ{R\M%~?[DMռd-A>tӂvEPƒw8iL^KK ;mK/K N"(kygS G|+ɀݪOebcHx$b̶h<4=3fo.BkޏߪaWLUMǀ*'ۺ0 mY韛T7ɧN&-:qN:$h)av!˄p@C,m0}v)l054 RxU@ 8%*'? z04"b5i% ~*46Y"m FeNT-|K-37EVYSބjr$K1: ^-<:[DD>;')p jlmn?rvo l!y@x2&[HOаJldpP+5jLH̽4pJǜJ>p9:9" (^^{T4T]ٞ%<'Fevr1.Cx D &RYc8)Ti kVH.gFa\ @mpwfj tm3ٕƊǻ"`$y9~,(M$$skArw^iS8bBrBֺhŰز/4rvYGdH4~scUYjn^)YTi΀`fJRNE~aA"/KJ"9qL^ 8x^ZIf@ mK]K:}saNQHij$o)zVF &rRO&1I cgvs \l?`D9Z=S*N;L3.PpNî9kA+^϶:E}vYa۹Z$tZzKm_|]Cb8(K|UCҤy5j6w=#ő ښ8 BAk} {~:JR׶\h^P3nN=eIW^MsomeRPeۜ~..Ǝ^SAH%I;)؊ Rm=o8uOw~}r6x )Z<y%?{k/LL}PV qV<@aQXNs3UIT^rjAjbi#$/O+d|}A^X5.-Bpx,n'As]uEx'IV>?u1D@̋}\nFidL>(ao5MS=mI)[0v6/@x 9al$zS#(dr>}pYݖWK,\\E^ڍ_3NrI~zݶTcKg+xȤփUtE:ii>0˴??K`8fzC~$y/)- Ph<N#{Q7fNRIU _RSRrk]] b#oK/IOЊVW #_Jɥ+"49|ZTܹ+pkdy21_-`{e2Vl>9kk2,LJ r$qSf.K{ALH_0AaIlz~86KI?.q!kXU86 {J0/& m҂2k7rTˍWQH4ʋĩtMm;$OTf{.b}QJ}lO, He; π`m| Vܒ=_?+Sár2KHTBZR/w-J G2jBN^6iTuJF؀HZP@>T|R[942But/b+b}$G'3^5e &yhjU[?q#Az_[G/ǓwK-q|ӗ'/_!aƷC6\ GKHhWoj9KIw/bZz"ɹw5œ-HnƜKsGj+#~NNB*GrH MaS?1I[n G_x/rEJFgM!nϒߚNaMrK׋G vVlBM +*ܤDWCbe(yӈ"pˇX1Ƿ$@X R([l~X잁߶MBՋP;$M}eCx#%Ubz.F~\l2$3UMX&&$,&2za_A>Ņ߁b m3վj 6{<%|>ױ朇2fN: cLi4Y߭<̨Ob'$EiY|crBA2I=8k\#]Q *,-Eа2Ȣrک>?* sx>oNY`ȓRᥤNcgX\g2&,BVpmB~\aI2>PApX6`qaWMGxd_CBɯH'=a.6NpL3}$ѵ_#{yى|kϯX)Sy@k*ZVyy\^@kA&\!5uMYj>Y i0PNdDŰך %e%편I$]zPX ` nk2UFGL4Gvb, c~IJ$OPaһ"HǪx<]o>ZiMF?{$O.jkbQ޿ݰbr9U?dOJarx.YzHqX]#,Wz`9ʏwt+=w ]D[!nz1io>ɋbLfb}zbv_?<%5=FEkhrެHa}j9.Cs \A޷[Jp$%FfjbedBK yhɚO^ftMoBs5cW$1̓Wsm@jB*o|ai$ eTz[CƟ8%0ӓKrv$$,7;a䉝/} S 8>23E Ԕ";\sa&a:R`\1 q*m;ۦ6nL|ޫڝOԒCGvH uxNNtxO1ec0M 9_jLO;qxsmb/U I<2-$1vB'Q2݀RB.ԢUhŨʙ~{QT1;d{CA*RBO3'7өICu@eq"OpL}dyc|M %<|h^ln;\sxlI?מ;#f՗PbzJ{:1Xŭ]64ȕACg>t3gl-qo? m}^Zm('2ij#Ǟq 2fvvJ&Q>naU!ﴻ^\=܈ŕ\)vӱQM|Zo@sYط\ԝaгUv33vJm/TevRpoHȧ8^^vN04I;-j,doS",~PNF7"JJU̗JJlیe :@+HjvZ}6Gx=aIIZ]:MٱIS+,r29 GEZ kyN(vK2r 4aD95m T,SjҧNEp܏4S&u>:ӯ'{f44&SI =9KL9WG/\k AFZ7TѩIim\9 1d$p8+twZ;rz|IQ4 e?̤5ڷڬo?pVa^{ k$ZR>nu{k,4%K*|[M&F&1U,7tn,쯾}nX$|ft\ 44!t9#=["٘+a*!I5q̒;О 7WV1vJkj4[Vha$a}@{)+.M_JɿR:~'VO#W"i{ -UM aoů&2s1 ..2|+dM_ݟ,h=Y+lj$ 4y'Lj 'p%R3̉UEWm RпAyx3$!M圫7Js.+ XeJ 潠gHlxV;X?)ʊtrZS7eTx ݶ҇Md潾SaH>q.`« ,yfȍ鉗q< So-m!di},^l R, wl'[?O5s)(f' C< h?6BȝhXܞG;E )f]R\ݲY2DRs{ַAb[ϫ4K=g+X=7R7"-٘id0G қA*H<$0!0TwR$oOj\[s8@;Wy)Ɠrpb>D(s.e&["4N pYU)&)LH~~/R$H֣\%Vd Լ[*h/kYNEqYKUwBK-quݓ?xLA:QD<Kҳ<ÞU @Jn%yݝ5.PO-$ͦA:GȷT a9m6s`ĸN^/7@JW_r"~:rfF⍤+u`kCLKhI|Ӈ@R=;ĪyYX#n}.sN3oV57`x1DcVa&y93W)g%3u,wMlOˏ_řgQbG/A(KLNG;$8 n?[ճ.(sFDyl$"9 |-C0SC`:#Fn»`.WlyX$SnLEl>᭾w xxu~آ*Ur\ 6?0ԾKU%3MZ7sAү1N@k/ HhlK AcN^سt#|yٷJM55HW=)hz3 "|2RKj<sk=h?ՔŸy'Ӥ ̧HL̚H.*zRvqqK;{ _co!7FdIWS5ijvʱj!!I0:VyU+%K&n=R,4T}E]0.{c:WƢ%w Eg = 4\֞٢^PR*?'2Ֆ\OąhbǍf._%wX[ldEW1C?MX¦: ZQTh4&F3r b@g%3pH)]tVz-R%`s}oaj+hl+Z-r7&.9o6)nHysՈ$П ;usT͔7j<z=e!;/]{3yS[qwNZ @!e.7Ξ'o<tucI!cVP+ 0ȉeuBmcKU^Hh$I: IwƩK OͿNlHD/Cogs"m+]W=x?Ov7N5mA082Tun-ڤ`Xا&^ Kh2sAnMqsXM5L:>yIom8-;vf껥!pN,,iA-cbHlrcԾԔ |kAJNݾڬkW$`y0i*?u"h )^uIn/Ո r~cw$]-7"4j" x?;܏}1<_nZ=D h&7?iAI2K[]V~Ws ˉ:d PS:щl*6;/˲Z0yDeU4<?$g˨giRJHy a%P82bvODjn[Qy [CZVR9~A G(,]n^I{g l;k~neXDmk 1y\Lpu$ !90Rn(L@?gU >7Yweǚ߸kB|'E!?DΣ!$gzkS'F4A] z>%q!r@K+Dr|AIz&vĜ<}V`ў:钳w2LQй\4x_O*tIRV$hGB&HX0d> igXԷS2si'稝F }:{ǾSV۞ bXM ٕ^tM9MoU?+|m.W 117w %T z;IV Y4ٻoPT&ug5 o-Jy@ٶI;YV%zJw$$TPlVy;%Q81Q so/0nS6xK<(F_t-^胑Q.]ɸh'37S%4ԧw?ɟK:יcq>hh$#=^ Ύ~. m/J }ܜ< kǙשuYD\@5)jכ,MDDHkB]7Q!^dW7 jAf[C.= )v.9vpQz3!Et}8c~@/ #J2vSFt;z<0{9.|}%h˺φ-{ Cٜ䅗M_"tc˲'')lޢ}e T,oc4^sʍ;FAv"SL,wqS?^r3,udY :YwBt|4|kӉڿF+wޞگ9J5MˊdO yLK)Ov]7.'W3|kwM#۶CCJ$N+&Q)1QSqèeSYɚ%#+XJ2RHtv-APϯ|)8DK-9C*~ )k z:ý\ I>oEubA$#Bv2'E(̮8ٓ:#:y p?gA_KmvnR칞`ܙL+SaX$WӰzn]%[)݌SE lO5E:Z5vH)ZW㭼EF3Eo׌Er/Lww`IQo',<2scZ~r*FGQ=Mv9}1ؼ"i6UmlE"YXC6Ϲ|[:aX_mk<9uk >nܛqIB|ߌ'y519!n{y\8mAP#W+V,F _bx>l$ҔP49R0/ۓ҄ؖbK@Εh?+M|*Bp.ۑs#3yNd\6}E˨Js9\?F"w)@dIKnjhNӋ&1,7a~ o*WdKDj9+T`JB0Y%-?I#3Iw{burd3rAKͭ`A8Pa$Wu,]6`)4t^$B4wb}JV>! $z㭌8",7IE'"sNt":}))Wwј,?ڷl=#?5Kv,X^{ϣ23–He, kxzP/oAljI}͵O2߬ժ4o&Z5}S',JyVkGφw001q Hz'H5Obnd4ȕ*I|6B.+pr{ɗ؞\jIQnSswqmP#^#?<ƦN,T"OWdkJk5}IO}rX`mSf5E#%>v|M|{Û#^WIG7i @LU@^|+O? /D (|6Sj~NIs# 5E2(sI|)9$/~޺y23%0Tl^,~ANm?*gf~mK  JN$aaqƇ#v,q'rpA쬵? Nl눌qw4uܞ{ ;>mLQG۷7| קmXA\(qƹ#i[]9]󸺕d 3%-m*wj}l>j=mp8p^(R3h:׆[1k$My皆''IΉjRm^9{Iݻ8lHN tz:@9q3ovyEE'1p8 SnR7(m:]XǵKmP,U}VKR^_k0X"iC8ZiUI%5gJ'-[~FT1r} pj#yvT|S n?ɾ+%b 6]3=+P.7_SSqe;R?h`''*.IK8TA=`z¾ dGdz } L, ktc?y/ɎԖ@Ѡ;\"5N |ǁ_xm6_bCN {akq%P=Q½&Qfmӆ'q-(ft`$Nl'"8 A8Jn8_^,.'>b!qhHv7^)5WA2m%jyF VcROP9XȩYn}6˜Xbv:4:a1(8r" rIcp}1W1h>8E:ou,TW_x1B I_~)4}j]Ҧ^IrY/T{AܳOW @C>E-MM.y35U6e}L}fnArU h| -< ~gKb`;ǵCv+Kon n >œO$gxnVӢ;y4|w@MVߓY%J>ѿ pU:E)?KkTcsejYb4yF ƴ;ep@`B.@{ R!7); 鼠}`& ^yy>f@9f_3]'n_*r43桴K|+B.*+0V;vw2Jn+]W^l_.c`Uwj bIՀ9/d/nuD88t%e!0{rOi3!~?-g9,mN%7E&1KIQqVkqI%ƨ>l)zI=yﴍKllS#!.nuNJ*1Q vdz"yYu KB+R 9ͧRXgoRF߲:sSc}dR hCs\-5/z J<d Xݨ'=L<}I5(XB} W T{!)6, }rPI+/6贈c_#i+?Ei6aQRN DN8iZYxrJR6O~.c5iPu8 z!TY\zOMӀb[Pjbj$[5fОk9fyu[Ҥl*ߏ<,o=ot@orj\9s`Kt Qb2ݛp(ݶ.}<>Ni`sj ]K~꜍I"@/)wx 2 Q>BL 13̱ܮ 71r[U|Z/4UIӎȮTMQ'y9l)!'@KYSkm~ڈK7$9k)VZʧ t $5HA!O0VkIuOuOp%1J&ftb] .޹X&TZ^HA7G^VqXë.aSO']RJA[B^~"罂O)J,ϵn_W i 4%*f=᫅(ajȴ- N( hz Z,)E]Giˆ;s{Lp;9쩟ӾP^sP9D#Oϑ5}Vm޼9}MF UL< 5jl)SlҦz H)&y%Xqa&B>LA}Px~ݛs& ﮌΓhAbMCDp'z^Ky#]3/\*[ny@gnTaW]H1϶}eu$<RԌi} ]f ͨY8uUDB8h4F>z>е>_Nid%%+J"Λ ps+ɉP(v_-4^3!2##@0Q͚hj1j)?l/q]Mon bdg9]ga|j=(ѭ~MOy[r9/@ow51W.i>10ؚK͋? Ll+M7qBM֨ܖhi^͏f}^_@?XѦr p`R&IԺWr"=>ݧ8|hFxZu6Jp8emjn|5R# 5ڕ~𗣹!c{af(fz+UFK5zZ>,pz XŚ\lwܘ3.;)8p-5UlG_&?EZ'Ͽb+Sݯd`I`'n3%?޹W}$\~ӱ*ekӥI`7g~‚kଝJ8ݚ?"1#k܃>Ĥ/S,f=K9sr[r3&8?"̽{;)6ZZymCXt1G>SIV{.2\$Yi '\lֱ~oM[yz<Ǖ˃6z$_ 8 HZ{mY73a A w.H0(%B:p9(h)n€`K`Y )~{{:yדu",KJbD|3]ڼur^*AO1?ϱU|16Զ J.o#ԃoÍ 4ơ ?` &N#~MNH+홰 º}')u. [ᱞރy'I vZ]&*p'o,"xW2|," <^zM#i;*`|I<9naxR|-Π ̎G+S[$a8=<JFMi [> >H]w“dtǍD|Clh UlװcSv}*¸ɤq$',W;nSk;8I6gETٞTi6SC;Nڪk4f%JLz*_NL?ahMH<^rWs9GO<5o,[+/1=IDbt0&TOa],z"OEVȁ(0]fVwgeSilh:IX< (o5EaoLRHB`yՇX[,Nv5 üh(4V@u/{p"wU)u~sيEN@YR¦=߮v=7d1N]{B A]t%srHi%"`;_ j?R' |m_ܓ^x,P ?29E^MRѤ3U7m'jz"m|5/@LbPɾ6:5=0-@S;5ՃwNt:?|ڀˁe7~/1MZT>|6!n9 냭Q S Uxq#`(2Mmy6&EӮ, [E_‘P+bu{ (GB _G,l I)f1({<@:kF-7TQ/ @υKs78um?}nOD!.}91 |\W{O!qS "0a^4ƴ_?y{4qp2}l])7@A:ls 4FH땜XPH,fi=d՜$O t   GRh=_`Hl q=s'5 Xf|5uy)k  }amTuBsFw09xG@\Ty*%'Z""e.cH>cJF䥬wynߛ6oPI56=`LI9 | :J1O)i YIW/ -U?3ʜY]688B98٧SP0 uTVX-O|Mݤ9?8LIjl +e1JGꡙ2޻r0䫧tTG3+w4#)XoC%Z#mGWR[G|]z'O*I!'j%ƐSO>MX/eG4\<% YF5`Wq:0MI\w{_?-탕4>y(ۈ(=ZwܩPS@بD#3a?jͯPꞞ$OwƝN-od¬-%y7K+SziV_T|]4|hMw웋v>_|]2i]K"M\.<[l y&s-EAZI.3T *(кy/Rnw"g XXJVڴ^@V205.|RR* '.:¶hf %%ItZd@rU$m'TۢMr+!z&"&XXy|ߦnz;'Z{3\DXt9 8䚊So|NDa xQTy?r?,FTc t^/SV՝Sse΂UjԽ _BTpg 8M>d-J|y6&>lN/T屽VY$ E ni.1yсGyw.ߓk*)gfMhdѵֳ4ث',o5⏧.J^3wr#E/A}Wr? aR0hZI0&yP98Q_ƴ>Q5sڃ2h~Yz8 ˹$ypES=酞{\HcZOYؚ'P)_>u|C'Sxwևةp^j mQXSNȟƱo v23MzAwnPrIil )sM^N巕#@ۻ4uz7`y<%{Bvݕ]}/g$\>'ggCO5?MeR45-+?M`EON(d9W +ȟ%w +(T;W<}G^Im.ږ.fAYo@~2;Exn;=[jtI^x0QV'r1v}4t*ٮ^6~_ C;-O|l$T0k(0]D3>- #Sە&tPFm)Nb'o|2Yam נ49 {$7[ǔkcz noJe+/+h ȪOPNIo 6e]`JJ;hŧU:'ARv0Z5V\~ZNmt`u(A8~XPU%xS_*f Koy_]+ѕlғC*we?P ;uВ?}^dZjL$?#?c:/M'6s$ypJB3Ϲx?i#5Bn4[I] ¤0$ QJ\Io3Cehc"}צDEA:͟ɊϿ%JyqPbZ19wS|tNݛus:fA(W9K3Rډmxa]YĻr|gi0W mߣI=`ﬓY^ù5&^cm;SJ l`ΟD͜s d b~PDU;>]rGdRvMaܰ~N,ltB~ӪjA|mL\|l7cQ|tpl%B'nnew}g#'~RW ^C'qI{>Y@u6Q)ls*?N<4NI'tR Kc|C8omSRA8͉&#ʄ[H%74T[l*D>d;'A$rp¶YZi.76v@GTcwa   Gc6%T[25ɎM_nS:^.SFZB-W'B60+>C55u9gY*sy*|3@j Ye~2 )m;m"T/ů&A"O))9; d2dNړ[.=b[snpkqG+˱ׇd{SX0|poό(t9 }'E'.qTjy[9ˈQ&x( #NK `QHa7-nwe)$>[w*lT&%rRqx}?ޢWno j,%.xlCca}2{nJih!8aWz&tN etn9e'&y™c~nnXʑ -r= kwZCΌm9I3JnA5RKlCg| (z: u\ʃep)}9q"r0GlIP1RB6Wngm2#>`}rFjDII2R1= |I9 L;a>ٳ(J4RO>`YރZBp |Dr€GvMi;$$HuZxڗ/#x+Y<ʜc-G]>jR\2o8O;eL-T>QWblɏVP*؀ njG/<\'=/mmvyd+5Ԫw 1&3k([S`Ri9RI:ïrC $N,=ksǣw^i.qd-ly: w*Mթ\>8 {APV;EEwo]9 ms9EJ]w.>uC5߮I^rKw,[hk,u6ܷ:K4cr;LvL5ȿG]vlH~lH7_Iɻ+MnrӪƥuTt1 H=hZ*s/x29rrY{ɼN._ ") j;̛^~${yHX "-fy  R6|17 _-;?q3 tr>9&<Y| zu0^Cbv<9) b<ЄTڵ`3y+S'ھĶs~)xPڱ 97Ĵ~ܢE&h i\‚QȥyHOʓGLbô"tgCoaRn6(Nu/;@7H]%GP_1l p6 K GÉ"nI\]aeTz@јgԻR^J.SnرNnBQ>W?T^.763J  >|ԓGʹJPo:R~=x&OTwoio}Gng1mh=G@%˙NɵA~W۷tnv,o=ۑjkf PWޡ'>|RNyh)ɤl/١`TI,s;gr=ջvb|g>㚯eX,Oʲ i{s|E|LYq'KT6y=ZZ&dlJyYXR}%"i(.iL!2GwNp F(r&{=I{# &fko~ kӡIJŖxݯs@VFnC )s1 ڝBUB 5ꀞ ]bVzL  $_doA念)枍@vD|rSK&Rk}\}Z= h=^ !h'9|d+$N9ui/ BYPD Jb'\$m#Y ( <7>pp[I+ogwY/Nr(vHsPe=jXiĪ*o:E^N8eyECnta…zEKNi~f!}+Vzzb/xهFDv$̐J?!s>@:H 7 Y)yȕrW iqղiKR4EkJTohH#j&nr8?44^'^ǡE_l+Y+?YNfuNo7%c ϯ8/W/D59p \8R~yžI';/Xwɱ|73v\w !fPji9+=wdߥZ3(T9JA߉Czjq@ڀ{@>Q x|K~Ҿ`\X{_esއ8 =0vǹɺȻNM\lC:kD7jϜ++-h>ACqHU쮤7hXuKOGF|ͷJcI:55O;ng$_z*4P&#G36]UF6>C4iՒ,ށ;}ah,\fK3`<5c{T֨MՓy-_qIn<PEa%/Elgͦ q΃f v24ǓKFB&%xǴ邺t=2 {8 uk͕ŕpJSԸoXT[$OJ{ ,a+hnSXytcv={/17̿&ږʌqy~@ʲŶRT,o?KKKCAO6pYԩϠ?W{nϊy]+u)0%J eAV&@ rݘ)29ᓿܕmC͕KLNd0廂jNvzpZ"U~"x͒ 7ɀZr]+" ޏ:y~~ӔҢByP< JP?:^Ήxk%s4 H-ֻ7dc*R$Mp H&c⑷ɎEo_A6iԞ c2U~=ȟXGh~%kos{5.k U3Spcتy-?޽y:+MwBPR!b  dLr.vLԉ Jg,,`3mC,ޯ۵=Wq`L&%|{pRwD~+&Dt;AN3I2GkT;] 9~)J6R5V5ZInc$+^COTR)251&+_:[QsӷK)1w5 Bw)^oM- b/&ҖX##qWG^‡DU$L}:")I1IfV_TX/vqcƶ2fCGݮua{w gm҄.9z"pb5A \bϜg+#6 .Oj$TS'՞ yfjsr1?؞#Ɔ{8-݄rua8~mus,*BtPI|..%A~jU%7!Иh~&0TMdtE<~ (6I0_͝N8L]H oǭkS6c(P$$U2I3eUa=u"˔~"ː2B)p ڡh$NPnѪ y;o1@ M*iKMVMŴh^BBSVKϋ1tL;3:fgź[LngHJ̛ e5)qM˗ xqQ];f8NN,.'Ēa8 UGc*6l./W%]ݟ}ᬚDG d/Ybj5vS zC+9ϓmZS$V;s4iw*5ЂrۖgHW">wt9;ְ߮-aC۾[u{O.X 5|?v'8+cۮCrjtu3|")&W;Z% =ؕ&)`x=nѧVsqiyT j bnC/1?xJqA'PvȖm11 EYp&Xx=T.S0,}_/5Jy-&y8z19ۅ ~ȞP1xS E>50$[;THI`Sg[N ?ةmA&vQgF[+ym+W۶_GNe ?qCJYàDS٦M?Jqq7RADxѢlpu`E~":y>si?`q,ѩF LEU;M }X:IțTV4à yoy@=R22]}iԗL7@L*v^YG et_fzF\o@I?Ԓk~*R_-Y͎Tn7ўHF?#ZNO,&t3|fBKJZL@XkBhȿZ +K'j(h7}NJM!iZ;C=?5̕^v1Yʞ\up ?}OC"CkHujZfhY*Ot%np_~E "Jc4Sb԰Xl8D1JstBl<=+?}2MRbadR?f!?+ru%Mh\I/5͇վU"5 caY2.MoV2Tc:d2p/c׭w9Q),<{[bo3$}7ܵ1k Ijlv$A'%<,$*$'%SԷ8iYUؕ!,Z]N1pMTzR-{R1P{9T^ld)s\+J6>ه.L.A'4x>-mTP B~G)N\Rjv~>ȭJ;7xۑ(Ou?z)k xؚr#jL"dbm̯ @J,҉U܏<6"}@ަvF@3̬ح+29:]J~\E ::oɝe -hpos)J LEh9{r[ -^Ylkg2O)T;V? [U:Ri:F]nYoMKfTpd@=a}>I-h>G./tQw?O (hOԩv>J +Xk%Qeh&sǧcAL]#f 5TlQsK? re$o~t;P0U]`M/ tzBy}H%9@pCH$tBl*j ̂Z.+A^[!S6&yxl !?s5%琾,aiSfQQl &!W[3('zAc))bXoEM;xء)$)iӱbTPp)=A!_8BҌu,DG&k&nDv^ιb<0 /946nE5?5bmbO\ɗ)ML'ĊF: y^LR 7˃m[1i,s^ʼ$xpR)&t,)(_}!̅j}C;gҟTPvF6hҤfc6Q555-䡳xh=%uVLf{F}|;w;,NoXν^Oyj&uv![G%nsѪNd`[$KbI-t3ZE}S`؛ʠLogʐiDSv]Ty_K\"!bØ+xCsȎԇ>y#!6R05)O%2M'uՒZ)ζXE^%Â#}Cb3a2LOn7N6.LB-i.@f4{;KQOQ9aO(Wbw^8-ܵ |Ij|2\|2q-Q)RNB;Oz(y*CR =۹x*~j-);/W@>HɩӚ+i?:#n6h5XGn=\2] K̸uV$4S'XѪ,ķz4CI=x@Nb^ x)yy7њ %]ȧ=9 :{ ]mJX'ϗyJIʏAx#/rd&x)+;h+9 R^;)w_v}\}gxU|\vI5Os FnVUg5Or65gڕ [0=*![3-{j_Sl$B_T|ϩDarqe 6 %k (dR R7'DO6%47)ukLdA*jh5?۳0'kL/ C$ZU&/ĀL.^ttAr ޲ }\R zr6G,e&5rruqGr)|H?e_?;͚wqN\cxm=9#5*Ԝ7:'|D\ɒ5_^r2R![\tc˼LSv]$JAdG{ ΍"'70pAQ砯I UOl $o̱E!"؅vͅ,O-rD4K7Zj݊zG$ZH@0;QKx20S#d&ic֒L A 5;P*g8v͹J56x4_WTϝa(14i>Slӭ%`DQ3MaGjdTƍŴƼ=O%I7Y&t ;XY% t5/O>:J-G$>>:54MH;(6j7trsR ?3jݑ<׶T&q\T5q Jhc&1ܫOs&$^/$/' [e[PiwQDzD>- 2cߟ{Co})bd E ̫p~@SFKJ^n 6dlP_U'vР1;x[Bgޛ)+z 񣛥[:hWoFOuޚ$ [쳭dXJϣ6IF"㞐5 BRkkȝ|k!^o[yİZШY#+Nx!_(lD$ Šd"QRX&ex-ؾZ53ĂDZ= ^Ferl9vK.)/YIב0|r޹ %ٿKI 𩜳M jA+"HV!xKح܊JN~Y/&ؒV#`hW2F\xrlI-3\h;- m *<KxnQiwƵb ͚m/:mk 5?H1.~XN`)~6L;Aw^OglJN $ ]QK]a,*'RK _tSrE2i@C.qDY !RELjO'׼|Ya^H6\ PX0h5J4E0t"Hޥ ihu ,`Is8=9 8ؑTW,@5)L.yBhTo^]ng|EL׍is{&"q~-Ee=eV]<` ~1>}М 5κ?\:o%b^S+/Tui$]F9M ֩}}< 6 M";qYr_^+Fô~nhV sR<ڳQ1M%hR|;Hq P7G5 @6*VNi(ǼdWޭb^{BO>SX:ئ;Շ4n$qR%rG}\|VzE@;A-Y# ;/׌Yw +9.TA\l&U؉N.{48Rn_mF&ו울M!n4a\+1UrrY|c1эɆlsr]K#:Zχ!>q΍ij!Q`"NXwyjxzM˯Qi[i)֔d dET@6PRWZJA?>­IN&3 tR{ sw,;C 1L)GPR]mgl^Aoe[@Պl(?$XkQ( sRƱj5ɝJV'zj5T iƋ΍(dZ䗞LFs`q>ԇ}di+'`Gbb{ZtߑolW]Sbn:J#6y*cL6UqanݪIN)m-F wgu(XfzS?8Z\W(ٯ.E: fS ^߮y^ x_zo^uSA2fjqs\IE#CRK6e MkB87r>#v-L؝jj+uyyRS`b ZRTDϳcF-jSV9 ϳ9es*Ɗ>^)64d?Y_zSު)c% +.v.+8뾬`Msy]C6 yLjq2npCB E?Vdz.B̝sU#mĸ\`}>u0Wέ Mny9{)vg%i> +}tl8>6{Ľͥz:tV IЙ$i{!)qh+ q xm$s \n63>l' p%!`pNCčA8ɇ6}$RyLT)rAw:z!Ǔ.}PFTG? >ǵH8x HΩz /k{hmN>Y.9voD;q6j>ĺj{f_?Qt9dTG? q X~ۂNn L1LO\I6ѽvYBwh蠩 /d-q0}μD]GlU#hA>E6j!1jIw:ydSnc(Mq[P)u,buM9)`wJT1ew݃Xà3+yܡ7QWaYh~DH89 g x,ZG$${{ibJN %p}kN-`:*^P^^[D+Hp,uj`iл D :JTGHpә5)9-xވyϡgj8$0m>V #}Á3u昽bϩqNEwTEm%M#`Kd骟l,- 4Jr@1XM"Z6r~uKsL&[nBd;^6zT™nґcAG1 է^JjrE:rd28e_`c};Y"SJ J ŵO-d^Bn=Ov |Im$)prj59R _l &5ӏH l^&y;u72`tP6/ Ǧ[cBI8Ks|4HN>Fbɠ2O +}HL~ Gc|)q8"2N bYK~w=2Q:S"lԅ0f}!tl/Yxys=gNo!ڭN<2I"U=wڼo`ح㘴\+s'Ω<un~I?lm[@k!4M _\{?o{ݶ@- Ccb melwqʗW,tI8h}=% ͠p˷,UA0e3ÂS5>hZ$)y)o 6r{]9hsɼyiIk(N^!/2GnTuA)tqXϗ%un k~";&kw.TGbg985Ly| HD2>BHƏc`BކЅ,m9yVk ŏPmr' ,TaM[9J+ ;=`u8u{n' KO=<Q,qR;ךS(uL3ty:Ic~I}0gPJ( +6@d$Z~`UMJ2K)f3q}EҸC@&m}FGyP4C ªUdKud]^.́"/Px!`ѝ$9VtA9o 'F*ǯ]ԄܼifoHFЖ |,[r6K"wOo꯳Ӟ|!rLC; kzkaa^-lN`uG \°$PϥDj-5R|L[X>*7|}\ ?{A)T2>J :{M,$Z$:$Qs0O}ڷ:&dh)EYO@yl2IL71) 2{ę Oa&:sg>PPkڄcʹ;;l>ݙskb8S/TB1tj }:u'r)9c+㡏v> {R;PKZ\+=OtJˇ$b%Ď-鲃ɁY7F̩Ǻ:nDy׋77b rbhsuNj2 C>pyx[WDb"[}trռ]on"glyr Z[Ọ-yvdV*64~6FmSU7[ /2lp@ucOPW^&|@t?h*(nڷgF/=ɝfm`Y5GA>(l,y-/Ps˦bRsVǥHc*jkt= ͚ZX=b Q]IH3W^JV;\<8MuM8s4rL.)07Lt|l/!eG_ew^\veh~% l 0gB9R% xӥ&wɴDE|Sx4ٛ,P"%U K^*ly@7]̓D9ޅڳ8}jڔЌ Fr-j֝,/T6 K5{B j>t-L122L0Y2R^Roe)_2lM"30&$v غ4fnN|^Bȝ D!C`Ͳ{.1 W'wSXmQ;y^*&# 0KYDŽi2XXy9p[P'@ H<Bi;Nm#Ι*, ;Q/z0 UKK7B_D5 L~cB)npYZϛ}W@iRU{M/9R[W/1Gget")*~•U?{m]-M7gKs6^6ZjK<<.B0 ܿHCH\#mN{}<&Jϓg.\{bni qp` `A&cQTFIH ZF>M3x;B9˩)؏+?>8~ 7#%ärڈZ1a!:iNԬi{wG<{j2/KWS͞O:?4SV}4ffTNzmW5k8+S<%s[n[Sۧv: + ֏.gj[V?R<9LE9 %@_|Bm{HC8Y&t\7'8H|o@3Wyt5އI$I/#Y]1nsh88~3v>5<Ѓu-bPܷ^JYۀ۰<){$'y|K\p`* mĚ$$fnQ:I3v#vayX}J4/JHɂ7]ijK4:#q$tbi|,em:_L`6i{ĜsFMx[r|;+T ;Qzt[˞XKpwFm8I.v1S0HdXCW]`z^z>݋R(ȗ/K9m&nvQT<&@TcV<ә`Oqw̤W@3q`-dGRsbLo'wf d "md úVb-}3ޤN+'VOCsJ~:kۓ9瘤n!J @OP޳b8~XX"J%AMmQkԅa WzRHZH(vz]NvK89]6OH3Л]`ȍ} [3,ؖ;!boP-s%ԾWaAI{$)f <9 DX!ƒtn' $b.́3\{^V'7P!&;ǖsxcVDub]񸎣W;0$!Q6{RLi;݄w x-SfjpQMd9/>`MP ;t59ƭ@X9%fyr+z|uK gCXW_6kWT;_{6͖?sfq+8[p&>,0S+&yD'R C 0 dhp#RWk'Pm(b2֜Sz$6|()qʃ?f-օ|3E-?gv E'HU۲KӬRʒpt޴皅I=_٘%T^;L9`͔%mnF๋Ndiam7/Fl[X5iʇx"Z051ϗmdž;MÜk"˔y 3QZ4L޿"k 2Y܀kG%CvdJh6ݻ&6^w~G* cN5_ ƌIgEHlD͑(>.R%Za i"yɍQL\?و}* Ⱦ0B?S9]BW{~ƹ-olH6%?$`Zw*DnJ&BQeMU?QQz0=~,iB*5uM!OTEv#i77F{+g;zNoȇ'T@|BY !8 J\*]cؗL]-sH?rw߇dŤEĺ/LK=T̔In!RB#'-nR)'|J'O\Rŷ|dTөʒ@-%%i^˙30|;kGJyX&*dY-}L,Scd $'4D1p}*:542K"5y1PUr'\E$}a/A>hr)&xx3DbxZ?)YͨHh:ox+Y:M}su_!a$&IvxlLlcDS)v^X@^u͂-=Jhgr=_ [#bB'ʪu;ggND&y4Z3uPz"I;Ƅ f,rۗC9gyHCIML%Z1Z9]jR[*mR#m5|RZi XʼSʇy\_cwJXSjht(Y$=J31^jd|'*J>jBprZx~ 6ك(z9~/Ch'=l9?K/zO=x7t'MRZym7W^&TuA閭_gQq#Q:YhA::(6ϩ864PT(H,5n:Mfz%2RD_ ͼ[x\U@){j%RJFⲐt EBmؕݨ t@՟U7.1 :1.hE K!f5 dۓ/$8Si b~$a7܈elYE7>n 9DJ98ΝM=H {\z 竝|= mrf8T=''5ZOSs=.n <L/y*pr ]Aeoi&ʝERfc23^(]*}IlJtḺS/9%#ojևXNJ'bRʅi3I-/A[juוapA^&;I&]VM+eںǧC&y; Aq[ڥyNlu[m9|?f/'/`}q\ V Y XsMv w7G&`331vef$INţ=G4b'[YJQ9*'.KB < ĎD%PXԘ 9\Q%/N+'NH#ŚROi[.Keg"_nA~֣ ~Vs}'dLR9r2R73lN\›i" 7*BI}.mM`ilʩDc' ])TsXV ) $7 kbE ;QO[21UYtRX\6}Jgls9uO*dT@PUpKNy\l)0^:7rSlCc77cNkt$"SrTwKL-pac-Ưܗ7&8m*Kxa־]`10sR%u1{S`wJ5G@<OCs 7 HUW eDZX؉5ZX)_6C9ʸ b&^dg7^%(`(r'XS2H1;A%/A?S6bR7 y4gp6bN6 Sxcߛ#^tiЊ@Xt˘]d5k/?-00Hb|%ք맭!4[\ k:%ِ|2bYt^H2:F͇]ޚ3Cxߧ=l5MWHd6Ksk?Tkö6sם7́Am9,-vZDN'-acmJȵ&7 Jm=U˶,|@맼}Lcd(4yNcJl!Ib!z<\nk@ [x1ʒ(%(+MaTB&9=(jwMn"^~qMlça:I>>ᝁI22|>6RXb21-1eЈǧ }yY OX}Mu>7V[\;֘VNRGޜ.b"B/떀ܔԤu ,5s۲om8DVykb\[o:CzNU1 1l3Х\88&xW%Yr zT) OsIRx6cR.U<|$;!Y-##z'\Nx`aC1\䀼N(4<5=q$ڜOyg}SoNq=밼&*QcUmn[˖Fq'tnjQ_AKߜ՟j!aڊX\`٘1w~f9h/Ք\}I)Soe'?s~=M@RI7?GcyInS8?l|[_-ޠϣ-Xg1oLd`HYhz{-l>_:'EwmØ|1<1};̞diiDA4.˺;ޝu2)/h~=b,4`dluO1 ?\M,Lly-\)bD&sݦjnIJ~vNtؐ3^"I3xBNm0 ^+ Dv~>2t+TnmJVS3x0'=J ^1\I2(_ې6QJ`gSu0 : s'WFZyca6 A8j`%bYY0qCTӋ[%d|ی}.bS+%~C>7F&y@}'@ĔI;&+5_L\;>Ur3dAFY } 4k6/Lbv 588/dJ?I$563"FϿNO8,^Ke)CLfoCTz%=G΃ƭJ^}"}FRАNb?uklo)7!z<*yP<%ƗI;/^^D zعqM}mO=PLTj`i/ha9Ze2ߌA՘79^Aie Id=5tfa*L. dnN e`?im4xV{:&,I;i/Qm债hh'D%DJ^&uJF/1e)z~F~"@fM4߳`ѓ\bY3wĝ'RX&_4v^Or Tr|lt˗ysojߦ6Rql|;/?I5FS9raJbҀiX҅;pX pa-Vtrl[(tٙXCc%jS%XWt>aIMoP);|'x`ԖNU8õXc(l5/ȓng)ܼYghꅲ~#؟G[^p" ,c$OJox[y Ϙ<$\h ư᪦0Ci*N$FW|ex UEVe*_- ֡~'z%9Ւf!鴹auNnI(;޶=H<`?ҖE8EV wzghNshY-ʩ5KJuZDMb؁F!=H}%3 aIsbNcd$@@gePbn%U>SArV|^BA4 N /CWo7Kw/&r"1+o'Xq]/Ͷj1lp:)~70ii:*OdyrylOy3*Ծż7`x0rs_ ?{4I؞o^]E撌wܘxvym"Kn0x[L"7<~tFEOm)P&2b$\ ;a1։F>5mH5&Ӊ (z2,WqE=89Pp.#K4#Iv9=3gO" lՙɎU_=5)7űdro+-?@s`¦;Ha,}ȁg knf1Ej_SĽb?|l<ǡm眑xLp:ח^]c}^huOC{O|cYk7m-7zL>TlEl.\Sy{ʼ q*ܺ+>r Lup_^iZ0 #HcI"aĽskKa&gKmH\F?v!S@QNLMz48'>ye)穨wR[]u'\Dy3Y=đT6r ax;w4?%{3'^3O]ݏNtlbt&nӯ8r$;z+yIΉ3'LV' )&B39I9, _-1M>o'ZZo Ar[ ^eي]3I&M'IqM7.> kEgΤ<6]%xMqfɺK=`t}Z.?uphBSyυ;;,M4;\x_*o4II]0\٣wyqd9]hoo[i%[y]X:;Ea6ڀNSl4wȿjD`ɦjD2;5010x^;my BϯԽIҐUe}sLJv]l%B~7f]8JY->7 : ]9-e} 7렌jX2p&7K)6Cݷyj>Ͷ"< #H7"7AԓMio f1ԥ9Vzhgn3j M*j)KliR~%ȳmis8?I8npr; `5 miC1`,ONɟPcOA0~9q 6d\ʹ$7ew+|97Zܘ̐IÚI5k]K܎jFejzObCEHd!u6+9-sj`E`ʋB,G㤷.ֻ@ɠhkQ~4 / #fR4;@kG vcV0A"I{cԶaិ_Ν]ww oŠQ1j˟( >c}ݦ:km6TyCԩt$5K,i0mou+WtL|̿$/dj\J;f ՅM9L#;"5$#j_#'GZj nhV|{iP]9D,TBlpY&6RkvyϔFWQС-w{GZEӼע̤N ٧ H12F[ unOE =W3'eX-g#<9aj)k˶Or!ׄ#w KnH}-~gnr>XO-ĸeZ%Ci$vEf.ѩ'#aAݸ &RYe\]:7rF oכ)Bf#sO_9M(* ,,3M?7Y&t)ltWSmSV6]MnEiT e 3Iˎ۷.'K;_dUAv oVDkdb+RFzƷdgbyY&cY:u/\HG[^{uF,|;.K_P>dOaZK;97$Zϔ o/S(3r a8 9m\=%3s"%`TB)[*YHHNrbR\j2c\彰rR ?%&$4SDph|~2_wf{uu.-^$3[_.D&* 40>H`XCڣ"KrGc -tdeEQÉxwv+wFoG I?\ާ]4<>5!BHSO%ou>afa~wV:z`4;}h阧'I\k|5BMOqS-H9O;v'kٸ} HrKNUk- tMyOgSvBYR,sr3ʳ7[Pƅɏ`&ڥvf˸%v`҉|+Wnku6P6wl8%A1m&A*x.N``*q3 ~H& ~LISϞTn9$apCK9eއXONځ/š4B/U 98I}~}?5R[%R;75hh3>yki`7P'XP?5U]|0 pV;g 'jg85%4?H*eI|m{ŴŚn#P!xEog,QsҾN96^r}/jaNFM*x@0uMso ʬ^4oNmT2DGtYf'[fcanT)`}'T>.<zb]VKPMZ-(5˘͵$ LżoJO]0jl[)7O@riANˤMڮ_qJ#8bXզ; ëq"cR:-c隒y]5ns#!VVQXrA=$4AL)p6DI{~lv2{ؒ-2i9edn\j:Y3( r?$a%"Ȝ$a[Mfs > }upv3,J lM&h[H8TRATthumsh_&)qIà7I"kOef姒M]00ڑr :;SGM!En!N"z 5z8?Y =_ K%M LZ&e[f cm=5^аH!,}pD+Fnv?^iP98K͸z17K{0chVz$\oHMĮ=Ӽ.`3뺛=!!~ΟYc1mO #7t'V>~]0 baW}?UBHs ;ߑs#-hJ^nv%S|<]ϊ|yvmuD'-I+?zi;#SIL5T+±yIyoٜϤ2:l6,7k8S ȿu6jW f}e+ KQmn{ߣL C*kW,ا.qBR"6~ssB]*c˓-;&XM=^$rW1v'xt3͌|ᷙ@g1 yuHղ+99(fy㳪mZ[%煭Nkd$ғ¦W#Fraj7nuO*tp^lָ\DӮe6)*x"HNu} W>{~^#0蕬j P\4c<ߚ7S#á%٢z|ssV(y7"dNelzO&pCۼƑX5@#8RX&'I `c\@gv}TE)Yl[gLGg$J$ߋ![Wb!Q"K@BXʁQOm%7տ#̌:5%OLIh\譧=-d\?)N&NYA]oYPf쉸b4bD Ƶe{}TyZ[̟Y c@DRΘ1!w6,|ީ9+Gkw@[B W!õ}W`{?ەI8Efuaz0M[=#}QSUIPx[]fxIufxMj=0TkNcϓ[~|/1; #~3 BJ/I|Fӣk g)!KH5ϱ:F'Xi9*8 E=$I5#%8t ˑ_+H.n |;Mi$z?O}ۮMf/n^o8x~\H?wh* Hc?=ݫ\Vv(D\ zgC9Ν 8Uŝ ^r6-9} S 7U(Z4)z{vldž/v}Cȼk;6֑ggrim)x?Vj@CIߐ؅$Cyڷ]O:b* =^THZgDh(jǜ'/Wwן4c9P^ ߩ gNcRP+_T7GNJkyF:5גC M9VFc =.c ^+Twm{J$ LPmyi('>Dja)ƒKO$IJCE"6|%!>]sbN#E^󪯅p{}~{'qu! <{h5 O=T.DsRr&SBQ:?iY\LH}W9ӳMVI2)>$ m E+Gչ @ڶ-nB|K!hD鵖6$4K8(mmXhE'7% x|=1VJWb$\ IE~~g1k^VbyQ, Ml˛涋|YKc|~$wƞ˜Jyq(O+$JWԆhWuCQ-h:i>Yʒۦ=[(ӱ n&;$/S-BދX*:HC+7~N+& ]ٝ\4s?pkRT_9n5"x~ܼIߤD)~>h@\Nʶ]oϺ*^3Aw[`śQw=\N-KGʵ?ҹ8h{1w -jEy7DYa[Lbe{|@4|LtVYsYИ*ȵ=NHahC{Gf!\rHӓ(R<,myAS@"88gleϝleܢ6ȇs^_A-)@^OE-%ѼR:9٧;}y%S"<.Ƶhy2>oPHYޛI0wTHM?*;y8<֘6O{<}5LA5%-m`GyV_n mΝN[T套"* gJF[BqƕeKpL@͢N>OMglB Fw}\/>)|St # p74eN *kH5A".PG!emڐ~L%!,,_FuO 4J`ڛ:f^U&-jziM)WL1yT]DM qiܱ6> wpnJo08XٶR|R޳t'x%1f8~8C:8#լ)%SեzI?2pCD0!;,66-]x^d2XK;KbA8NZ{?nǹ}eKºk|CYDRso8Iמ^4B;zZGK)?֋@ijH[+FO'z>dm<`;%IOnq$/'tvb ޕ3#-Ke_gp/-AB3 @k稼6*\(rLE=a7I9#Ġ@ʒ1}.#D3NP]vؿ BX,&OS|1 9-6[ХiBMED;Ȉ MzX)j(%d䶦{aөH=`$uɕ92e*$"Vμ/$]V݃#z0\e"1D9 ., ,ܽ |M|N . $eM(m/4n]݁qL""3W" KVk'X Y?`y:)M}ghc.Gi*J z9gHWBYGͻ&7GoQ M$ Ԥ Y'`OofimV1ܶ;RP9h6niRxea~ڥѲԦ<Ojicntr4BҌC(ӱ@)Gq?mK0tzLxZHy|FI0vI IZbw2 AGݿ˂O'nU|I\sp޹ gy] WY+1"2zCQS̋WoccxWbs%`f+,YRáitk9-)K0G;?S-uCw'JIc?,4?pA]f+j @n,%Ν'Hr̩M>oB\B)M,-;ǻBͭDR6UC+״}h3yI]wT;JMgK>7dA| Rs|}4֪BpXhxk`E_.3l'uס mNr f!{l-OmߟI3>!{39~."KHlz/b}TxQS/zƎMC~c/R \HSDIlӀ0զ ?*|/S1$Z_avS;%Mq//99"3AI-`rl6'AOv=Iϥ((K`O@ S}߂29tscIQl xҦ8C8'#VkBYq`lOhz飉Yy oKuiAvH^ޏ_7^c #TnPS & I'M@N7P^oV`o Ĵ1Xz{K=- '}`RgCĒA>AY_$oiw^ɞxzuvs2^V\e)T|CO+09bt+곝xXL@HL eΑ{X۟)H,6$K}C8"dfús,@z9$i ,rq9yDNm09r/+i&zn8VbY4\u&v@ )Y&4JϓMe9h#}Aؽ8%9lM8?J]_$Y\s>Vn^ˮOrhAEmc$N1x~'O|ŌH?ANyR)YDMK3@_@<^56 1mX,K^Hj;a;gESjԝ̃ JN ׅ1Ц'5({־Sid?lʣq.ۙueUn>r;$}AJz=F4FbN V'2TS8/iBV 7qqU.νQ1 YVIv\TcCH?d4 VAB\r7KG⸡(a^ӗ 2<`R(㩝(\%6tBoqYA{5usCFr2kpgg/ǜ9ю˞Sہ贲C -TO&IיQb?`CJD'tcITsVB )>S6arstyA')F[wl\" 2TF֑pgm_ĸkXS7J)7#_bpR/985( ߘ[Z5*KRF So驝Jt "t&B>ԪMW^7+ߴDBvmm9jG5Ak>  k^R{C!h '"p1 iTU+ا-p`|#|΍ SwY8 YA\$h-$H3 HL\226;M9{hTɢ|_P.;!)h,8jndrwɕp.dbpKЙuqQmJTnIə L'dbeB獝|/I_G['8IþK#5 Jtu!\Nlw$ͺk] DrP7AJ :_L<qrJhR"q+S5THn/ 7ty-'ߍTwp L:C7~m7o IiI:Al Ur:J8K-LJ%_4߈+;B{rL쬨%y|_V}ɥ9J=WTVUN *&1m5'i%.~:z`i bv2EӘLRc&OOLdjlG5e*_j!5(?ئ@FO1c< zY,9GܩO 28ȅ3U0szosiuukUS+9a6NN59L P b/oP֥B:vv޽ZCw+ldC;m_b7{CmY{c) .)^.osezj|,c*QbO`sqɝζmﴵN!Xc3`Q5W$5ۧcqe1: 4ݬLY?`q7yo{Ճ.sb"|H}eүy?84xgu}<_״kțS>ik8Cʋ+~ScY 9W}Cems`AGS #&Kֺ͆ߥ֢Kaԝ8uJsu*i'q9PYs] xIP 5QNƃduZGa2DQS!WLobK]!y×T-dqmjԮK܏m߼u珶] 9-oWږܔ?s;WY|͓dT|~LrNsnK C ^T 4?Bùɽ_$?М["I({|DFfYd|Bt|ۚAVa4`OC0'|QLo F/ؿ07QgSLX>..4DUvP7nˊֿ_<`+򕰸@ڂ;A޹  QqINw1 >-w18p^vnv-&19Kqa8Rbws?YyK'EC 35 TT|R5;b{p7 oOђMa5V>l|aÿfy|Y Ean mP:yGqvvB֔.E.3;~Ħ/V죍uiلi^11rI|P+E=fނ]pw,/_lysyzEn2l#V_w F>/꧙HHy_(3} >ȴ~` [^FXBc%k)"8Sb$$[<9:ÞDi*?$ƪklaap;S.?7fߙu#gY:d3LaC>rڈ:=/\ts =kX%1BqY= bZVrlo~؎o½O!ޙ+b߯Iɖ"@x{x0 Sۡ\ȃiп=FnR[׀Rns]ؚOKI׉9VV|/5Z@;!NݱO-EIBЎ8)3`-QbqK2> ~HiYZ{PiTTyt-s#ۛpE?%չX|Xe|Huq|FVicy|T9WZ˓O"MmU'7p%8a0~](x;[c x͓&/by5+ ͿtwaipX7^ˤV] tW)@q;YNXX|t?`N:[_sK8)ZgQVNӮ۰΍V10 7_@Ey7XO7%E[QyI.Z'*b`#lfiY3;kzһHY&t~yh7SN(ԋyq%?0nC.Ԧ#I',GQ[bX 6L2_9-$m[H"#v{Ux f9It&y҇)mV ry YSO1y< "4u$o_n4Ӆu6G7&k8rIN0;h-ۀXh#t x$9 ~H91#%Nʗ "qC_k7^SKdPo[)MfןKHz\#CmV/%AS˥-_B>Wcz\ZA6Lf"kbA^%0Ce *v1̱PX& OiCUBTrN5g\HѵNFmvGgʊ^)V<9h٧ZrcFqIhrĽ9ũGԏfKLyBSb6$;6:b7BnC*)ފ;g87sׯCv&>0Γ@7&xmO*ƍEE5Xf(hdmn ͦj"GH@c%Vs44BM@xVz Uڒk@岷WY'cADf^ÉVy5pr*nzMۡI,ٶ@y'F/%I-6=5K: d`CQ%.mPNUr« Q`%GG=5xnYK.I6h JHvy 띛ʛhjLEâ1IN!5>S /C]X.̟ϿyvuX8oqFs%2e7jŰҩj浣2..n0P"BO# vD`Q94. 5wOq?%Zm͎VPrp r>,lB U֤sG8(;Ʌ%& jHH^=e8ImRY1K۬T˖v+B%j]r:9`;ߺ*ow9=Tl&灪yQ2%?"?} kҰ&TN|^M&3&/Ls-'" 9i)ym?W\RY3 R|~:,y _YP_kS &2 siDNŞZ08-)y7UCك2N+XV=}(ƞ^8\Khfv^^6'NYLW5͵ՃO'#n4TOmymRiܚYGP'wzE>s'r@h[Jnx({i]Vk@ Fϳ;y7ag @IUwJW3Rrx8뛍TbǔN T \%&9,Eɬ09͋uD'S(`\'ՅI@nucc%d=+ /Fߐ i]NJXXT#ؔt (l>&`6!wR  >`Uz~NNފ!uj",܂Ώ-O6d:yzy$ -?w2k/*9a$89?=aZ\0LR&xOW3xYS&_G Y\[si D1ɵcRI5$,=m|;9qX.ިSlٱN`* SQZKǘ6 ia99r"{wfK󝦽I~ RSQT ]$TIy3} #wNGfS]E1M)B}KEGԼ;GQƥfI\S_B7!NÒo!![ @UĐ!OKD47;DtxqFeiA$(U\t9H狖@Шr;dzg{)$:J癩䗯c&?Ll5t vpSH>8>y&C{ ]:%S4vZɳȋ!ܴ+srtnh= ~[im7Z ~fInٙCweNb ~TsC`ڞnj`Q'xqSљhÕIx^a*MRtNi=&ĭ{}T; Jv(Yb( OB `)骬ܶ> T(F]OD.9&įܥL5\,'yA&bI$9]XMyxe[E`1nZ`3 Z4lOkݘ.+aYSDc+)#5/uSLŔGD2:ߵZ'<`\q~'㋥Tiv=rICWW&kÁV1ixdsIvW Uvƍ/HCgxq=PgpR`DXQ@탰sPlbhԒau|$@,͂Ipubi7Gta3\}(*}cFb.I:l"蜆Z0|ol% ;gr fӹ|kLU唠BlBL)ʐ^.^m1S3i/$ZgK<0=mN?Ja/OR?y{$'Zku =)Cd2R]I@snZ,U5hj[>\W %1R+q۹@Y~^c5сZgl~o&%"9I LI 9N 9fyEyJʁi7!btDSBnxfn"4RQsjw26XAA;.Oy<,abk׏Z%KP |=U<ʼAtG0 ߷[+Üˋ =۽: ,g'w{f 2/EL.Z 1rab@KܛTx9W"QrGN>"l~`= F}u&9i4JRL۰D%y֊l%{#SM`[2)L[G O6gD7u-R Xrm`~ <)#7`6Ekx>bmK[ .%!F2le9??0G|М` 'yaH q5Y}Ob (a`Fb Yhyr.'g>YnhrmPu)`h ޽mٰr8HGN°X{r :jW :$,7~JĹj\RSu+e;%x)S??xd:Z9X k*yeV[˱ Ԝ !G68?siQx ?byPȡ˿iR Z2&̸Omf> $sEoFBMIն " | &bsj ǚG0UR6??|6E{yBç3 ˚wE~)kSl@J 6 W;JvI֏8mn;Y.Z|]5,w , ׉9^6 q׏mNT=צ5n-'` &qC&GuD ͗{AmגQ;aؾ ~{:፞|d/ E2`6`)ŭ}_4Mtk- o2aR潗V}o%Ea{Kڎ|^M(ޒGKNJU,x.kȉX9Yn>MoSVq 4.ڛ˱ "*((e:wKYycNp_VRQvK6.ɺA:fo* ;n-D~%,y*p}5ON1 ԩC/o”h)"ۼeΟ4LLHfN!x`a4:}imEU\r0ebBltX,SӮe"o6x-JW CD![')%KaN& r&*rЈ rNX.HSI b Ee+Jzg+;Nr5QE@e ms%aNDMzR,oi4p1‚G:).ѻj4eӔ'c-3v*hO&ʹYzUɕ7}T8@~m${9ao'mVB$)R$lr(k.T(Gpq8˱(JJ>.H뒺x?遑&t@ ">Y8懐AP;x6F*XdӋ[6Rgfv/UPChDl2/gcnײp2*c|r[f>FwzyGyKlFM;|Uʷd1{e\  B,$2Qqm' BeoND.Gck|ZC+57ࠅߓ1"LG~5iԌs&{DMm6t~'썎bKAԨg~IzUG[=_nUNC1.Nr-֋:U:ҭ4g"QzT>%a-@M#FRϒ,A @RPjUڿ8-"8| {aJ+ ޸k{.X߼uQyG:}()9X8_\wv\rMj߄fK o1:ˑ γ%IJDR|fLAx,F_ }gt߾SzxGiR^ m ؝+qz^Pkƿ g䷐Kn LTݳHoL$>PԒF +Ӻ"7B%6f rWY LEJaQkI21mk1>IҜs 3 )Adc+f8rBܹPp2̥ G;"q{9%o/,1DnJ,Z^W`yWyDSh4Xjrmd0poRPuv&OjJT Ts>-K9ROOŒzJ~钲$7< k+4M#$.I)IWK j$LЃL0zynt߶,ETÝ뉭`:+_w zJ?btdoC;I9%LLG>Nfd't0~M5Hj)lZ /̢E 4{ge])Q>yE p3)ۨ]/Jt/˸+I]d 9ټ}r[hA%^uebE]}")'v3M}w-$$~ޜKv,1KmONE:y1!^ ``kav_p){*VDxc^0VV幨 rpmdr>^ox3 HOEEWیwglN>s}%-eijL)T\Wx)m)a5Mia_9jP4 6Ru#'wiNLR<%fm1la% a+]aPmƳ|.LD*bk2'#d/Umڢd69}Nqt } ,[*;f%!2(f{A%WaY٭/'.IuhKߩsŕ_I`Ҝ\-wFIRO| G뎩y: d<rz&FY%jpcT6y< ˗QB*,IB8wQOڌUyM5+uhr|GO`X,ĩ+ xi7rLDLGʂ%11eք%m7ɇJ.:mX!;Clr۝K>X_:>mTC̓Nst)/0 -3 Ώ1ղE5Ua*Kퟛ]NCێ˧-{tRS<^Nm0羨Gt ^gS7\"F*H,,(8o<"-N̸^%%x^ȻPJ4+gCj.Ұ9[?oJgscWzAfy)kIQR)9^4W?3;r~-,6';#w~AցXJ7<EN.]SX brbMd$^vlkxTb9-Ajr3ρ:y~ } q][0;%oqY Kz'c%KA}$8qrR&vP=6[^4ϒV{w7 (SI]Gkp4K㠐[~q#WjAJ\|o69:KAD5џ%ĢNRKM7/Ѐ4av{(@wf+ۖ\[x:CEa0Qa%".4’5[5d癕W aE|5g*HY{f^6jpM tijO&q:aP%:y+N;)X32A&1P&N{3$oGY#JLIJH7/[&WR*0Rp#R lwW[:jm!]F%ϥ <ߗ;GsofB폞fwƃh2FXhL*re;E(%6} 0D =r I|%U_{?UAP~>Q+DwՈt~4-XT'`yd%) Z5<9vU׊H氻/f,L!?ɡ\b=Jq}RՑ; Ro`oV^M fbZaB{3E&la8+!Ľrǘ5 '9e.»ka>' ݵT1xEO~_wyD{pݡM:yY<_R,m4ƒs'l3YؾRguki~:,&$r\1 f?& oebUÒD,s%Jl;p+=z5Ss;,Ւ "C0+}T"G 蠮|ai=;/[|]gB6xѴi 둧kK~<"Ѵ$ ɭZJPu7s+l!'b]f]+ڷ˥d)-)IDdAb X| ˊWd0 WÔ(hP%禩}$G'\/hԏj$t.!7JN3+#05CuJe*%L2&4/h{+?v; .v"{2y2 F;pF -`٬@wFG <'LwЪ ,סc[[c? zŒy ;򌦏:Ҵ<^fATdFAsf=|j$>B0[ -+s C0qMGWL|V].ۭkۓCRe>0[ Љ7zKTZ^c䤋zi_˕4y(y v:F5)v)yd?~U뤎x0FqqH)*]Rxx7ȥYz~b63#2@1$ RWS5qԒSYԷ]_F"w^s燘JJ`YqLJ/̳z !v˞G|`XЮm$hxPI|esy+cĭM-eE}R4̻_[V) 3xZ_> dĮ_0Ϗ J$9NWǃ?AlTFzk}91 ڹD!fqBM0×H)X>jU`$&PX(޼ĪS'%Vs7w`3/U"lԒ\t'Fe=mJe-w@Oe/ˤ0M#䵕[8o[FbQ;cpP8>b^+^@+Y%78PL1եoy2j fiv$H:?Z!aku2e7`uM?$,l[פG5m>pgiDsT-Ttky9$R-?m$_C9 IC^s{XnM!L)vٍ·M<K`L&FtphfJb .&5=%[mP'ѽ1Z|y\XB}2լqY`t"k]Ԕnl7>]R-[ \e"m;0lsoW,K3&$Zۆ)90EaC"+[ͫ>#z2lVIK1  T1yO Cf۾=@ KHA cT2|#u{jVtR+; ΃CC|Յy; | jsΗ\Kʊ"6Ȑ !ѓ}Ԝ֜_ӦN[钟ْV{?|$dfd/F`K p9K5n a#3hCvtRhQ3LzxvX~K=R@KmB7T| jKg&!vZsNn)keKvly (e(y2H{1S\lKXʃd"/żx--H/,՘Sb )C2jn!$a3f:[?[ގU:_(9 aqqxisNERf}ӵK3Hz.?\vZkyx7mcRShUg\;8XsveUZ; WZ 9"[AVy?nN,I~KDrWm>y@FDFz?dz ]>-.AγM44N[ j_X]3'?zP:.NA7Si{,=ɆWeO,5%X&t't:n5P]B`kY*xn{ȞϤ\¥(׵V|7Db<*>Q7zq u.ZsWٰᆾ媶n֚aԾ̓h.sNNspK] Ym`sۦĔ%v~#_$R[JF)*';;,z̥* _4_f0Ƭfnb,5$o#^Ngx&1Gcľw[ɐy#7StxG QȃoCp3\l̄ΊL>ۻ/)vZYUMծ"?Iaݭ2Lxac0Z?IҾ8d.ڤ[G+q p~|KJ^kkKW>&\WO9RSgAiC?mh i3\kMĞlyAÔ`"24jFk%@fm ^*m_6yg`Y»}縮"VMtI6d #yFV1+[`#݋\^bJ92>Ip+y`? ‡}e>ѩ7j\rt~$Wn`fWkR>G%>PL[sSlz7h~e.*ejSѪ'u=N4@iWd>\x9AJ`xXJE1 >iÁRغ`,2> ͊69p}?[ /bM[[~͟ےʆd괖-.k`J#cd>ޭ=g3 5$g1X7\ }#6DP'50z+\|32;Hh uO&I-%Cj /^ql+du` JiSJ7l륀|M?1sV(lX k0wjkuS6^;'%Q^.OwKi9G h3r ߴ)r`E1E+,cNt#5f=.JJϧd' oJq$(R}KT͎[X]d[>\>a;b;cn]%s =f7ZI9 g$0{{;JT͵#}礘Rj^%] 94ORgrMe`XW'k7myjkÑ>t69,vao# 6j``ǿ{y䟺7)?G?Mkjh!y(LzcKzb$ {ive!vϖU҄崼sro3~A[BB~>3qrÊ-L-8PCMFp/)fW"+)YE+TS=7nIj +iV[ 6g(81Q#x>ԝ*._m\YA^ӟW^d]TQd2GK1=;,yO Rkfg2cb }}(@,<" ܸYA}*\hkIhDu{fS;\o*H@K"K ėm˖Ūg,3QTwdm-";' u$r4 MD7WseA z/rpxEN \HaMn -ՎкuN֏R0)ԨYrSs6b=g>ѿI#Tec푋G yKK졧cޖ#-mGSr&ZYgIz>QȿlUm$N4SC糬F8~X)C7ryQLEG֔T)SQT26g~CF(+EvMC?FI;Q[=@L㤥CD g;%IT^ciy-E63iD$ zR_s\kR5Ȕe`]y&< pr_0 q/[I k![~u6D:Js^Ez'oP~*%3|OPIH=} hggC%+[OʌvoOVZ}WAovI6<7 GpIdEYP`j $3mOb\~<#U&MxMzi[~#QYFCL\fS\ ^ !ܭŠh%v׀:AǤF-C.ٮ7%,S/ IۻS9jM:I`yW\&'ܴ4;?+ڊ5Mӆu,m$s'˩J+[o{ 3h'||\IeRrvZ?D#9!Hz}ĸX&-JU/aPθ΅DYNGU4ʿΖ\[J ҹ׮͛2N6WN]2xx$rMAn+AE?,u5.9cJ$:[ѷp,/ّTWFoOn7ah7$jI?S4?=';g%\gZr "xZb;ۻLO8Y+- ?[SR_bPm~|T)f=45fB7\ bh}ލ-2! Ul|x89kk̦eԮ@#Kqw̵ 0?@@ [/!KJΛ.MR .2EMx*: K8ζyJ 圔.^K~!ظS pכU2m^/.;ّ u4f#y(YceJxgM5G N,GމD!``okיf>c=Ѹ?ODqј_ yH U+=e{}a$d%q+M%'ZJĘN-9 ?|,y kޙBޟ8ӂdomQδ)SKylN~}nXºLDSܻa;)2`/y9,s"oJ7_ V V 5yQ'$.kq0s@n>)EvjrA{''1Xȳ1ͤs&1'^=22$7;Y?۞"t5Vˑ-ܬ!8k Xh,ULu8(*6H )ѻor.jJmNevh8є\{iOX֣W04CǮ( a/??AUvD? )G#i qkSh9B7șu$sDO`;?]G5ZrO2f$׽RjiW8 y#6:)G RX\+Jσ #5J ]yI\X8=\48$NIZ(X<:nr_?|2 IiH|ag@ PLCHK "6nH4hf+9ܙ#Tg.Ij|& oNjyld-D\suĴ4&zESӎ-1/1n P}nxt$e{_:Q|Itne•y~֓Q _]BxI) w εʧ Y?,ޔDG &bxJ[jʾpgi3 S d'ˢpN˝/`+*[2`IC翠%Gə_ ܦ4'3 H{YW0a˖rs#S5keEfM[JW]\+b53㔿:9.5=2`˅:Q:pk̖D^1dlgwqk _b[OG^ԗ}KY,v 6G_8 :5e``x:aRRg{Zy09x).9WFՓ$^I;,BbDf(ɽS cʘbg^;w\s:8tX.s/jѬ)v뗇o_{ p>qB𻷛IEMā(@D(R 6V$<`И>0Yo"{02Q;_$sԛXFqDgDgA|ڍQ%6-ִi5?ZP$3ӵdG9h~.?Ӽ>RQwMEZTDZs<߼N{O5m7Hy죴Nd%w1*^?ro^[и Yխ|>Q': ^r;rw67-pE;re& (9"vG:0W}t!*xX?88)bd;%'Qq2 cӶ!OЛ9:뱗cCMdw <H16KU?zKJS'C m \[13ahM?p0dbK >s53anO>y2/7RB3gl2 @ώ^HdFT6%$;-+ y7)d솋*z2& 4Yʸ퀬ޤne̞o-b!6N\pmV"B[QATmTY}%D7M6!8c5x@`wtbh0]h4& 圩}v]w;&9-~قn(DH1>_D΃<4sDT%Zp%#%N ^\AhKX9yZE?OG9``E{ N4~{^.ݗda˵ۨzvӯ@gOIInD Mf[ZN\P}̀H\(aֹ<ˇѱz*i<$Wd5j{2nb'wq2"ɗ a|"y4"I Zw2DL9sBh0hsRﺎ|}'PC D $n\?UKc>R#)ujyx=ӕ#|i[X:~ +iX9v.Zp*/1'K+)i<0#0=|x3y$%7m8nsFk<Zp2\ Rrw-Xy]W%=rr!h)$hr<6.Bɇidf ??Ȝ4' #;}L5j4R@ K_AH -:E/Ecے|.nLH#9<kw{ ^ʛ(ŧ'Ee|TE<['b{_˭y959dM)X =Nh3'k$O7jdn5vy ~_֣,gˣ-z!E3ҺR}dn.kNpr DcͯV6ʓ6Qf֩+b0*$y+Vm$TcMSYZW.`wN 밼} {";7\a9d噻s=g6S{'!*p$iSQƏ^޹Wojfq _0Q&L1"J%+,#WG9U`>CBfYKt3f*&A7757\vJ+Aݶ׋-wj,3 8Nʣu_S!{So;FVw H:J~oZy2S~  WB[]wlH '緶&[=R#3ن*!Dߟ~A 룢c A›MsdP@KQOȌd Dp, .Dg-$Fƅl|x&pggqwAc`xĨ1=fkhJs5w ?Wt/oV+LT#oÒC@Pj#ط}+%e%P$mD#*`|ye}($+C:(3Cԇs;6V&i͇!O0ۥ'O%=,"Snխ͋ݜҷiueg(Wa'~h^GTC9؃$7-P_9{r ,?y:&vvnlKJW鴛ΉB{V{L K\hh li+ņr jJyy49qJ/';}`dHи}x.Iu0+QQ_ͪہrs59|Pח@ȥϖƾ$S6A^]E혂0{ g4ZKI%gA$!E]|5:ަ`4#'{y,j[2EŇ)r mk7cV5q GInsOD:г vK ͗ouRf;+A6Y*'vfUZ2|asʟj%лcGNǐVl~6 @ $] -/AfHi ve>^9?!*:u|,R[RTuVyKޕjh9 03+ۃD+b-ڃh$>qiIxgI)lBm\w d23 \8_,&JWH%5r J,l?a _v]o'62A97"BKNzWK9gvK'jε(2 s/O=n^H_ ~rWr/=%_-E KZ+k>srH$-gt,Y0b$ijgRqlx9d9rPW(X-(Z( |j<ե3^4ɻ<OYZ>f Rs6Ow!>m h\J%nr4fǺlތ߰c?9ErisJWF;&_x/r:V흰9י΅fN?UYs.]'ć 3lҬa >78rԱX ΝHiCruTDZ|)w)%'_v<0sÃ50S7V;IN+ 1ƪzҥH `>ωc0[.?rd,ׅoB"JN%xlOis8PNL+M7j3f:9Ip.ВbSeY ~:aONK)4A #^'n;qND0䜓d=ҏ=h(g0RT>W(NTgbeN\u,x%6Pc.nAVlALjl?kaR'v~tꡲjGȒZ#fSv7u_`>)+ cw48O|E:v{ ǹ}O1z:8{2Ow`M%$Oof;w_$xn,:X`i69>Lo\ĚK+"!4$S` Ep/P^>˲/ qҰT7Udʱ]{Um n.ܯEc-'w ]ى;: aܚĸSޟjgl4#tyF׬;ZR$ZƯ[kb'C+ |4TT-SNUBŃq2̷uϙO}]{XLKW5]io.r 2iRkfgNcm;bH!ef1$PxXlg\L2K|t&܄ KWRs)ufP?Tr(9%̙=NiZɧ3)bVOvAuN{.s, "cr 8/#/ZxReK^Rs݄.`m'Y+ö}K6>y6 ㎤X u>7éȜ0܄eHg*_XqC\wߛV/yZ$ D#!Bt{YpUMHq/Kl ŔbXDx:)='OӞ(x!nq[YPn\_J9:Vϸj}O>Ma>,.֜/.]rJqjrPM/1~o7\`vlȧ0 N:%b|sjvm`fy_ =Y I u%hwDXq:I`Ӎ{Nf()iz}GsI:Y/#5~[ӑ"n"TǗ:kJ%%N,;#b֧ݛX҃un{!wzxtp & HXs}HX=D1LtS 5XxbGͱNmS VFNSYLjlD!fsw۾:|ؕaStssnx RE] #?<~ LSsĬ}h}Gkf&|iK WDW)!vmKhᥰ(Y?[j _7,Nq{=4߶Vx oeL,HTzH۹Ew{iSQ0% x -F}O\$}5eA=/&PlrW2g^Ȝa  lᴅ}k*j~}7[lή}|ޥX|$je}ŕ7i-ڌ~OyNZ&QN#+;?SaA~t5yuҏhǟq[7${ 12懝wu/DH/)2l$6$&UM *RɺI![9)Vwپ2%C*Y&&ʷfj^J BVv۸ONI'$l;طVa8bqi0%huܔ.3ձ\4ާ|dsoB d9"i6>Lyw;)v+{A鳼t!vv`_YyN @q.1vKmq[aoPkbs4l1a&w=^hQ:,@H@o~`rgl(%Qz)1=-| 8xC\L%֟I gŇƒQԼy (S^ȋ391ם`V }:O>$Y{ 9.!3s ̶D[J0X/ɱy䦼?ie >Y`5s^Gmbӎ%kcR'*K"->PmXE%$L>(dVLۯ,%&a$\>f A(Mm1~3)qퟞpkXJt%㋧?Wcq+NI=',ITOh"0JujKS0a-,YQaz!cG>h%'9&\ 47|F1_(~mYﳾљT:!@3%tD dt ^+Oq/ L0S橫[8]o>|kCS?hSK o ^2ڨxЩC֬}=,}An9VMBC@h,Dhl]:=ŬUՕCdNڎxg=~~nciy OY1Ya@g$N߿$,ZHe8$anܲ?t^c>7 k VORvr5,~ٸ"5܇L|5T^бljk3?6YǨA]rCkW.A#u6Kv7) |*xD)Y1V쫗hS^c;al(k;o&{>([4ڣA^(3v+o3O; V&d$*TSѭY/'3qP[G.dP.K=]*Z_'N%`:Y*w҄+yFdؘwK+gr}Ѥ3*_J׸&Mf*3kT=}+wA$}la[<]J\{%#$%.fH&W%H׏h/gM!H˄ $hX؂:ϟZKYA9fλhM)IS(|gp%Ӯ|蹪r.E_4}=9wͤ~IcJb#Tҋ˶N.2m}X I4-d+q9H'q`%q>I£bz%ZlWoR'9YϪjn`ƏI*2 `ߔ'^` xV#߬%gE3?3PǘwSI͛S+Yr9~쪧}=~8~V=-^_)jk%oOgkֆ%v5^yA\,y@vNn/vT s\k-)kbE^% ʮ0&bĒ~8qjB9߫ Hy?v}5B-%-hA(k(v9mm쵯j4ELX x_Y=kJAN)wT,b <;a3Wd-2iIQ|wCZ,P9آ6y=8ckMR!E؞ƋU\%g!$+86΢(zX導42S4J/OYkx>9g.D^<Փ CC}?f0Joвҵ͒N+ODJsqʄxp,%{oLFCտQq$ԌIYPϞD{[Sz^ʱxЉfKMggp^vPZ zԊo#-Nh)@WejXq_K2)Rϛgg|d&-'T+DSD).< m*MA6ժL)wg $SAm4dU/ڽrθ}}3I5k8T-MרL]ķ_JR#v\.Sj$'bY=ZhoZG 3yl"k '~>И #%4A/ }߾DmFHe.˖2R0KOig*_78 56A7^ԅB zyhm& 3Y6wGyN-pQJ'yKgv5GJq=S{^"ds:rR e炋K 3q2'rjJaT.0M@i=^c0ecW[ rqFOL-?b {!o>)Z JBI۞g4m+/3M@,u xgcԛIHŒxxBIuL!s qR*&&>%_*smCO%Aymuf )5N@x7bthM+1!/-gxl4.oȔ2extջ+6>}ΓN"Z<-K*Qڷ#=6-6sNMⱿNO@욓h/yI*WoX;Dt#ۛ/f;WI!H|pdMx8ujFEׇdJ}_jrtS\қ%)|Y^z1TX1k[1QGE$[837bM eEu4~|BqaqO5\V۝ڃ{8a b AO] ##XQPQƙ#"YB>IϷZA)psuq1)sgÞ3,6< －8,@P_/.`YK _QjyNE~$?Òĕ|N^m%7OIfe`khs?4{eέ 涆53%P .1zLGHC(^"$$& ސ狄B0ehu_ͨq0$!lj.+kc\n̓ӅvX=.2`h였) i* 2tV\g{T!,Z4x 8Yl~o9L7' @5/Y:B!9$?p;åWxQSm0[ϗoB9J?43gˏ? U^p{ʓ׃at~Fnk\eN\R1es:^/s8JMs JWU1YnXI"`" '/Sk}l~y_B&?UFAG% AC[wQ,9li3DB׾; 3L" oϚF&v(L) ,I`,$}\3Ʋ &:2J70exp>'R';GJwLEbm6; [$gy̥^@*?HD̕+e^}]NsJS,((-͑uFŝ)_OBvR\SZaH=9aiV聐ƈ+_)t$B<,6 \(,Rb3(Xq٘Nl ur.~CJsIH@>$ afߩրa[Vy 3 K<4Cu%%vv(TڗStl:F d~^_1ў}M*ufeO@A&;]-5_lstj+yn@u(}?OW+,sS!.2qE1<ӓNτjF'7ϜAemFb* |.}"On\h rMduO~TUy ?p:wX2bph9u}sJ'︪RJ=x*p#(a#sf ޙt Yyd0p7fwh6. NI?*ttě$%YZؤ"vTaX`'':SUPi+J!-k@Ct2.)0C-_.#'ɊxCh>, >Xĭ=8FIE,d O,VYOʕ؉xIlʎDc\ n5ɱ=g:p/"{ZNklFr9OsqSݘUܑ7$F,R\l!&kYL F$rQ,a#\[d\^Cӱ'mh|zRKjckJU\\o~1OcrLԦLP{fv;/~$ē4Y`"953NH)K팢PtЩI=ߝ/{XkD 5Y&sk: &S]VyX-W)xMo0ܫe6s8,kn(Y9;_?aK3*g/tԖ"9<,XKD'R[>JlE9IB {rM>+'#/ ns&JZ=|$USU^7F| Ɖyz˞Wً؃amGϪ)U:HNYBkeTE<8] b#"03& hRތDp|wO4m6i m!WtۍvGB132A\RlXScR*ə;ʠF!& QugIq{5.h$#i?.5 ndJjbjҀq:)֓>j1k;tsnW`DX6`^@1tXϟ)HVnOS)CvH#}<pO8?dq#6TN6M->jk+)!HRxSZjֶ)O%!lcT-}i|SX#-YuT̟U76%=媷Zs{E?ɇ>(};̜0?ҷ#ixK}":ZCpѓÀɳd޾S9N~`m:bsroT;u-,# b$FܷIehA ].sRߝx,>O n 1+ڠHG/de"]OIA_lyƸ5}ufY /&Eg1 gQ}WlK䛆Gw)V(@~zyKS;Uo%9ʖgHI0ӈktUTR۬Pj9UlT?m['ZQiڗVOyp=i#vnpkBn3S:y|k#袑9a[?[vTXt ?Dkd9@~>LO6nrAn]xVĚ o05 YkH}zxvXy99̾1]/agrh0niRr*Pn\DQ+O,j;_EEaw)KK]bx;J4W-A3~";*HL&TR~J8qMy[.u,*O6s&}ySLyzK"Hb J>\wa'64xg\K!dm'O4}[l?겾)-(`brZUfNU4zr5Q-Em\Moi,}99)rw<)`AߚX{SyM_TZ&H(-8q/|'6hדOrRc% },V:mߣ|&[$}#0siΓL+^;6s 䧅aj{s{XnQ83Ϯ~Vf,C|_M:x[` &&hd8ݻN^ 9^a_J`]ID6+O烃҇Aj'YA>NToES8D?3=Sdid €Ny.D6k:YNl֐Cz@slT*XQV $ONYEfp%4͏F-OĎ}ژn&x㒆dNtf% ;1F2·<Ӵ&%Ƈ&Xc@qn8กȽ K֬ErﳟvrNq#笛]Fh#NT5햑=o@A r?r֓q~o$ss7Hǜ_שc%u?-O? O?YeLtßV|Bg2AsZ^KD2عs\u&o*T׎6" By'JkAG@jxq<<*RO\]yPa'i|W?/ ;)&n6ڟ)֤̋gʛٹyF8 OV‘xUqFL{eW {.Ykek'nD3s/dVVtp/&0i݉a$|^(Og rwV-"[ r7"1ݍAg 1LUϷ|S8=qX0KȜcϊ/*^;1\=ͤŝ!vPΈu1 NaՓݗzm;RDy_>&Rn[=}owՀcJkO6婹i1nTR&Oetȡ{ʏp$A}﫻(إpHN21[cس.L5ۥz4߉k\a'%ǐ4ͮ!KȇMAfb (hJjGO 8 -؞Ev'r0V |Bj$3-'_@jcTk3y%{X/_PEcwd.PH$ʤ#=;d,S_Lq|a#%Rҡ9 GJ؂Iij#83@&Ex#~)>fR[Wp'>$0GI _Ze<:|9얠b㳦E^g~Ep֕JF>Rl%_"zƽjr)@TY.Y"湬7&&+[k1n4 wMU󓈳Z$&',?dRUY~a3sEd[rrT{yɖDV읥$2Gy$<|٦eU-s[j0h8 zEF8Xpqvv)h݉wPlާ?_|9NG/ےnf$WwΤ\L~{ /{C;_%i)6ha|d2gMLyzoQ 1%Q|M}/Jd)òn~?//~nzA+G\͟BJ% {$]e9@!e}0p њK{Xi7U#,T}ѫn8?tfN#?*1 }Λ5oD>TD-hj47p898}2X\I^ %$u+QJTЀhLg< B*/MDGA9IX[!ЏW[ϜԨy#Q-o'/)q4Kn ;õo}Ɠc1N<J0*}&$DͥH}Dp klˋy-?C󥭑po8~⓵Xq$hV#/'1H)LtYʯ/χl 6;<7;o^Gr&tӉ5و,kS;_ذ6㩣Ld&;d7^ Ʌ9.Ԭ\ѽ$Mqxg vەME \!Z5ͧ$6N~ yn,p yl Ү nMss e;#JKӳ+mqUK[Cߕ:ӵJǔt 2k`BDSp.2NbM&HA; x-7Jeɼ9Rՠ!+n{Su/A1ow? \ȿ" i;MǾ&Sܬy/[ۗ-aV_l˪MLvSs*\]Ku³Ҁ93\ڬ6;: jAǍ֋FF)W`H%^(A(`)Ez0a-3U/G*ؘ=0vEMqg;x hpwSmI|eTK(МQ}įԝV,)Ph92X--^f[iHV,RuJ<?˹QdT[4٬j4G`zE&EwLsV$j=_ skx4PrM 7u*vvR̻C/"AlCe@߼'ѕSK5X<(0ϓxQ|-˦ _7MG]c9arR8\qsXG`.[[_|ejirP' |,WħRU3%ޱM#7#5R:0oOmRYtw+4={v6&\) Rn;瓑j'!Y~v]eYY!@5@ʶ;Jz8LL" -|Ͽ96)T--1ޜ$FD`R?5z.>^l/n?RVD~bFNLBy..c͑S$-D: IS> Vw4mg_v2@B*A("usPz⭬Swu` O/GP%)W -1{$ޔ拝 _ͼ9&qvw._ۮ?Z;nS1`ܓ76.ua.2Naб^ $(I%y@bh}u#ov! k8}^>f_M"n][A?,P>'я"ESg$SZl ͞/҇݌[Zw Τ:rm L@"qi?3]rOiӺӼ&_*`(9͉ؒ0"yۊyM%|F1W q?yo:N4(=~n݂ݻ;͍y^y7'U8YD1sl4N1Ҝ[!CoM7GL P&gpiyKBd eڬOl[4zr$ǃuS{Ǯ.!3 w/du*'_@pFq/a$KQ<$_[+Gm愝 Kd%ȵ5sv0W=*ץt1kлQ<s(0W!rk,N٨lJkKfCL崄 f0jSݩ; Nsmw8-JŶ~ma>jDZM& 0Sf 5)ʓ`̧bTg "eYbA3N%](QKBfBGʟtޚtwj V4y62~z\qŸƪ)ATz1m}&|WRa^st^p|5b.,om?DOat;?g|`& OmF2sI? n5su5?0|s"&}<9QG>rrչ?v]N̥ܮ!3J>09-W.ԌӶxr/ܫsO`ֺs3GAITV2[V\/WP|[r˄"'4iغ!eE/-CYzlBGrn|OJx9)j9LTy&B=SIZVUY'='c9ҷl<[@I*=3a}%e5N x6T 2!qs<] )l͝tWO):V7DM^KBD>fR~Ƕ %QW$+9w_`SkPXI)C@xb+jj/R3GZ62EEr mNRN:`LZ5s>pSB2\B"EJ[ښ$ZH;dSV͛t,^w@;Xz^_^ĩU$ _5fq89K͘+yϤ>ICےuo=þ 773zHT/sj6\bL>Z_إ$'Y[7`cbhS0Ndrt-yS<-t 5S ):7h[W}``~ESq-}R.0^%G2{9Y|-v>prsȦ=9ų"ŌH.g^?GqD$^RC=+-y.د*s Pv pރQ{ћAKsm2p=pdL []dήsM]~|s?Cr"?Ҕ?*up{OuJ@Lvee(>ߚMKMS0LaW-,&sG|ep&4CJY}تojT&kкMVw% 8 0R:]9HN)ӟ,ngg]2:9>R/T,eIbU zcΦȈ6{D"MIҽly#n6 6l>|$2]΍v˯kDCphew8en5ѩlTR$̮l-mϔ89t;GR7ڼX;}XiM wZI;!&МIA"cdmW m<)dǭ- p4`'π>G0TD-:t0KfcڅZNxKZىI~|n!(my;/5ȃ{1.*[>,Åt{JaU8|AB"48O9_Nb7wZsN7)ypG&1'Ca,S~cP+˺c5g\cPur%!`] },5w ys端w؛wGs_RCvȗjJ|eOx!iX ȋ`K~Urw>PN6ePXQnSg702\79v^Zq "^ 2ANz죷ugSfal6UwΗN5d} 0Z.f*nw $DV4Zizxp"ϡ4%ZAG>,X7[3lrb;|^C'8N?2ӹKƹ=|o0Kc&T:;}N,/`-|{wJ̎e)@;W:A* G5蹺LOFMﶍĽTwqgO^2ehJ_9O݉v[p&/ݺϋ_o;FrR%3|I釹 Gńɒ̒OȲ'6#t&+:Q스icjѮ~ intJZKUiSsOmfdaJحݢQ7:}).Gbc$٥VI  e$EGm2|Vi#}2/&RZdG$u9]4" $I!49e!I*N#&COaL-8pJi|KӠz +/F!?O/H*+pÜ wgO\VQK=K9y/T`^}ӵKcEk?~`Ov;q2(,ǕjZ(ʞQa>|abzӍKRa;L)JHO#U8&s/&NA qMNKvfBBoc% )4l}S?8\~0B\=8CK4GBs uإi &5}BTSo033ԛ=,«rDc4k;QIRAJtZHla;F`\Ǝ.B\;UӄxVN.$t)y05 M@SWpa\fV;WƷEٻ!SbXS_1 |㥕!XB4I xZyHV0_~^e-XӠEfQfG.UԢLU/4eRƵ|2PV) 3[DKfOO!Ĕ;D:;L-js~{Oy&/KP * ťkErCЎ²aB>6_E"~WA̞2R'!1s%M̱07|xvKr:V_s/B`;0LCrFbz,9&UnfJ^$h}&|~=o҄s.Ze/zcDs*CAt{JЈ$y=XDgm_~`C7>HT7)ɶ j(6QS걽ɹoS> Ґ1H{R89]8%GP5o4 N}Ouy^ukbp hd/J q)_$/;S>42Pm h>JXs8$\u͙f?$9'#LI+w$B^+"佰#?LV' 2g?Ng]=j)~2r+e6:UhإJ0rR>W9 o(-^$2&Kԁ´w\ Ap}Xx9{wa*0YOi+bi蜅Y=Gﾛv|y0ٳn_$щEcF )ۑRQeVlC1`Erzɟ4@fK{ܤ/7dVlfF:.~<܆6QS4%KN.ϟ~@00gg3Bqݶ Tkhʷ#dO!Olr. [7! :@==^C 3]$WKykFF8>#OE#PcWUSh|^@E{yobbvغ+ZE,m3HnK^rh FVrTttBֈ08C(b?$Ȅ82Iv N6]Z]\b=/gvaͿ7g^׀TO?R'ђ 9WUySבOu?jŚ˼)s߻e!đs(t-yN驟n%`2>:ɝhAQX&0ؒmhkpߛ3"UӢ^ȩ.-+w(/auE2q(spd~4wK@s]M$~^Z]Xh◀xbOv照p\ [mՈvKy-xZ2:J ̈́Ϊw&T)ȗ1 4hRPNW`RU*PfXNf @>SJ e,aLa{]\#kʗ1i e`X7p4^h|'Ur.~[0`mn5+aTI7#A۞}v/zDSĠ>J@*I|3蒓ՖS 02J'{.~jէV*v _ISXn"a 8<2HtIyVsZm\jd. S&=\iL$=G@3:cC'q|S3m_E<G'WV7rr0~uҨ{R+"j 3DS/L>{zԡ}-!C3.ܘ{_6a@3&̇0N+S0Dp6ө7U%l|yNmS o.LC?G7Wġ&X4/ji Ӷf1kWUmcǩ'$\FcMZ]I|&$g?Y5xq??@N#&T9M^sZsanˍJt]q{ҙLRCr $ɥXzw; |͘r=YK OMM}T2iD"b2VL78Nr-w*0띪&TO|b&H&}1R٘Ѽ z(gm$ZL=QVy=i<椹y|T4,K=w1{ǘOakml~t_\v^:gڻ2K3ŧy}DP]޼ }[U^A6bW|4>-)Ȅ+FrZ80E5MFI1 UNyD_ɃMkK޶iz&K{.x}3Nڻn_X&49'pEYg~p@21V[VI.ō/y2&ؓ88yh1Cg K+ 3Ou9%ɽ֜\ɇ5؝`dI-,xqoܩDꆼ˨tLV.]f!80$>5r*_AfDh׉ 'x%W"?-0NiaJ"pR|> Mn[PnɒZ:Йͬ^'V NjE'pTV [u[^IM 3PϿ )P u 8nQVF_>OZRQ-xƨ=aK?DǰlH+Oʠ1T5?͵jY?;BlZ~T|ڋzu97*Ƕ$+Xvh8󗹯o17JjI,xFTzuɂ_^y#cD?/FJ)GaF`,<1A`kǖTp<1\"0$|mD)c:bQI)x3[jBv`Y&$.s+͓"ũǹ<{K`yGal+NZYS.k&^f]K>DSM^r|&oE38x 0i#3n |eN\t1ASwP$~cAO._R* H\[cy Q3Ah{"`RiOOwٜ?b .0m}] d'sao5!t9;g v``5y`e6az\1:98Р?kJWϙ&N׎XYVS,x\?O}qn/ {oAl\fNQL<0%5}I6qmak1E"VHILFbuˮ!ޓ~)p^ Da oA'q.rg4+)ac1!TV{1/à yY19/`KVwzWEGʺd?6yb#3>xOu|C+%kQ擕Z~r>fnk zYg1ZLFU:_""bLh::\k~SUd֪vҼm/{]m'-H4E71/cmܝu[SX9s-b-? EoDC"L1ݰe I咐dCa}>xѯd ` \S{ཌR3^1vw;vAR'˷V"]pVVm 0Gi TIY9.@B(eNEI:^^ɹ|`1Մ[mg(y}L0-2!'"$ E}< ݧDp &˼C 32:^Dk^Į&u7f5.UD[;o<(al2?.swujvߒgpKʑFJCjڍMGO@zNU%9driQXhJ V AͶäμiAl^F$NO">Y#6հ"Jecr Ne6%X) ǃf6l娲*6BUux ӼDNHi=VլI>p-f8O ,sNNA_ȆHM\ JdtJ%8.H76RTo$nس̱ :QkHďK~~0(yaN^SllKjR0 f,{nJ` h-7 #z*IJm)M -?˔w"&)lޑ~')ʷnnLoݮ2D#i˖S<3)&R(mW/u&s}+55ƌ!#=SO}FD;5hn^?G b ݰ%PI}Z©S-+2\jJEo"8IYoNQyv ӢΝAݹmʱƛ@?-ؼ$ST{χ*"BN%:?>b]@`q. fcehޓ;|qZ7<K1Y lg>COLy^*9hǚĚgpbgfax,Aq2gAO=;ٶ;:u8#|- L[tvJ 0%o4wWߦ0mI.^~KSܧ[i? - _kyk~.F#h"ry&xfJ> \F햾_rnĞt;V;cۀ\g6Zݲ9͐abN Da4?j{?H3/P>3;}JFXЫw:S㟃&n.Lͷ D'[J/>4ƝLt/}$eY&{ KMs16NuK3NP.Dߢ/w>Y܁1󹂄SE#MLkSI;)yÒ14I,q=OZ }=1vp[tȹ r5٭}A ѭLD1gHVDqǜ᭗x6&8nea3szf#?%s޺6HRF.7KKgʭS žRV]hĖVm<" -+Ƈo)ɼJԄh=+Yd*חaF2k wJoxIR+;a&^) 7{ 9*(A!E:%eaP$c=!4st&4`/ek*oזocT#TT z;bNׂo2bX]*"AqKi[.T 7z \ %o'+ݢN=<=b;|b7v4|y2J`TS27)q RJ3sbo5f[`/ `/b۲<gq3 4lܕtZ@96g<}>{v)HEo:љ nd%u߱plN/3>ggh<)&8hUmm 4 /}<.*U")g$;Q>/p>2߻OWe Gm\y&"i0"aqI)$ŭe6ZѨLb7%h}. [K"4!\QojHqAԸ1#Qj̲3M sǙܬayH2_pcαV{i foV]a['ª7*&0AJD 3O#"Vij|Or+÷78sMMZ#JzJ2cwLlACDXrFlv ϹӃ; 0kƱ(7wX+*R>61VBj HOfp`ZrF͉3&J? L惔eQϿ8'0_hCw&ܷ8a3y九V߅;6LYq>I0=ڸ\h!١yՙLsQNd_Ef':UA=N夠ƥ.. p Χ-jBbWmD4n֦yOyRF&?HoT&o'+ -`89޹V,u}Yš7v >\3n0+ϡ6 ܮS31}8gh'}tټ{4<ƛo3òΟMXTia~2-wJLuۓ+?v&-qDoJ)?o7vU> ~ymznWNk~ildmֲ:xճ|/Պ aQF3>i]ƒSr۾NLo+FJ z͡'jHUqM`++4&Oy+A|_/[$DߑӸqyFNa, 5drzU2/cr =6x2 w Q!էXs,[`Ğj{aS{?7cHz+mC.RP$  sV"7VI`Ҕ>sC{-/"[ Uд*NMAM1Pi ÑwYXBߎu۔V'VԚkhn CZi U=oc-xR\"K)I ୆/ J`NEZDqsZ73e-0kDN J[}_O ]vh d >SrXP+\/aȐ襲8{R$W1JQMX.|u 4bt//Pi^qw$f 47]jL]Z7WA|zGC.g|/Ʒ|)6jB<ĞTA m+ɕ$ 0SRDnE+YO7`)IrEG֩:ntZJ;Bqzwh=|mX/|RxYXUh$;q~h&S!˳df2 ^FlAq) @ouZ'Vpnrjȯ}P׋X^Cn.V&̑F4a7ܧIdR._kbk?wbv}|m.9H ?Yv)܃LH~:|Ӓې8.,5hpStkuڵ(9@,pj޹ᅝ]" oL-| M^F:3@a#jBu)t GuӰ|cSC6hgӕyk_г8Ȅ$3N)dND*WG @ˇ5Zډ|\QyJ sqPg"5|J2q Rƒ$U8 㔝,rrsBlAo0>x&Yjy7Ol^'U+Ki \K&Ǻ>eZy3"'P6/yD1{Rfs&c׊Xqοc.?/TedZn9B*@ϯQKZQYhLI;--Fz00ѩjק# v%{[O%'&nl4B%7)%{~5>ލw3xmQ9iA~-Ǥ-he$D Լ7Fk(3Sϓ.-. 9EĻ3ֻ@$ڦDFeHR{R?Ī<"|P%i\q6s>ȸڻ3Y| СV?]JuQJ,֩ttrjo'xo9YVZ2+am{NQٸT^/-Ys7Α٫5P.9{jWruVhJ8AXtvg$H.fk|^3G䴑:jC91j6ʿt#+VxT?8y6MM_YtYRVs/ʮs -AֻApp \xqwLRlmEH@C= T c&du'$Ä޹vCW$Eھf"ZWYuo"=)DJWfR>ƿ;&N9HxE%( Xc~^Rj:ZKG"q6aBć4eA'%8˴W^ FK.:u!_D|1hxre62~5_"ɏa6x\â;ixͼ!)-,,eHIkԾ+:щR89xKVZn'*4;a cO`(AmHKqN%iBhUS/5 YG#&hom1r Μ̬%DOt15 Yq 3%+ˌXjpkcS‰N=v>$oeLN [1dxgQaFhYHW])kGnF |_w9}f\cS|vJl\%d.9Wj;3&^zH$PЙtE!՟ >b/J5;MXg`y $I7p=ozBL0-[ӮC"Piח&3r@φgrGgv>kl}_a0irWm %\&Y8\MB@8 >˜90=[BwN, ݧ(tq%_Z5.<֓fc#@gcKzPg\;Bֵ$q$!r\9m0%K. /uMdٳX%%Bsʫ;avA93|7Fk,F0뻔9E{bo1AH~˽J9ˋeݶ2,_phM&-ӟ-A9>1ѓ{X}&HR, KQG )8{ -;l)Z);C?뜕AK!'+B{`a:?mN%|'>^Vx#sEYhK?MM[:R#$v u1"4g<ʌs|z9H*|»:9=RXY&q&y2.<Kmu nF읒tI65ɟr[`v+gVV9/ͻp*؞{;dyt.nЅI 4'*kN#nJ_ch7BL)r=14?Dp%M{q2D~ Am; cKafrqU43&1o J\%˗$9m8M,y$JLM=J PMI߯|dQK8ys]J)EWK E淠|-I2d)D+̏ϥ{@BRQ`]֯ңtȑwTI.qLp.a&~I " 0[1j4,Es+Rk|u¨$qO'&2*fuY6A\nd^m&|Q>J]Ji=dAةQ˿cBܓaSkV$Lmj_{2#1Z! (FQm2N-P#4kBLAxF4,ӪQxr2-xqݕQAv#%[e2$${ۄ`$,ݭ:76%="{$dM':8g_)-L zXdUPVȴ!XPt5 Qj<| 1$է &ţ2;)Q0&wP}eU[QҨ,GAZG,+҈'DBzeOJfD QGElVthe X#TFH^N,c!fx}{ zliNƝ jDt#ãjR ީJF{tm 76p'jn8IEa*ȓ.QVQ!ΣeA!-n ,p (Mu)ȲMdzB8#R2DG<)TMύ$zBZt`Jpʚ vh}Kj dI6gs7ԉ=tL?N`G8][ R2±'GIuY6.˂-ZLX^7ZNZ =Ai1]NX"#eiWbhHpTW@|-X=B =PejLzϾ٪evE/ˉ$Ae F"uwT蓻 %\)ԯ&t]cD^ZG*N&yt+)8OH$t%Հ8d$lRlوk`ah~;Mr {htE6H  -&SȜ\l DdhΝ^joq;MCF=bl2tf@NwwI&bpQ%ԀLԫ9cElIf?R,GA=$4 H#Vx4S2ťmpD;Hs`3"dq9=?I_ԩѬ w3F8SB!9b0:"-`d jH'F}Ēiuriy58}=t%p`&7Ese"~0-#o.餇CcǗ&o)ӈAU6?D XLFf@Wl1qSSI}٢Z\эT\:՟ €\`IHb&YPM +nPHCY#r-uUw5-KLGgW=Sx9 (TjF:սF$}@$S!4e^A/@ D#YCy8K(9!z%{#EF#x<} G4+2Z\M<;T < TP;&% QZˢh28-HƵ HE/u1 8W`'[=uBx<]H +ѓ ΤG y޸ 5V܎ 8|VDjeUMYhLlpT(wܺiAIZ彫͚yj1' +xBRO|J?ԓ"v*Q蘚A{fC>3-^'&(&vӍd V*\h9MӚ/9ҥwA[n٭XҒ Q eʷ5 ұ LUH$!-TTJ=&,#),$VLV5REؓo##ODH6ENZdKuL)4ɰ4U$V6UꐓC.uZ_g˲xd ).P暩6*+ѭ4+erGA#czъe =,2,j1D5&)7de1-n=Cl(;-0% I⎶5_l$+,km_!D#K12K$`Ve-Sf# KDEo]MeW@; 4P"nq 6jzrbգM Kɍz w%SX%L6h&4=r/'߁c[,l˲. PBSy)QcС>Cy$~1 d PVv;Bn(@_ .FM.DF6ǴL|e%]]ƫF^s!|t2C2^.Wo`pkMME悬38d,kJ]?# R/ԅ `4ZW%R*D2kRC/MH2< j!(< hB;>.R]1zë9^/_>/r|m]|]YB_maM#?wrh_Ð~Nu}:܎c8O۞k {^]|qضϗ;^ur_/7Χ4\:6l柇pݥtۙCr;t tb .pLv.qe :rN׃=3ߚzc. |r=wtEo[Ͼϯl>S_ڈk2o_u^ݰ!\o7N0,9sL=ACG=- i~|Xt?i;<4le}ya>Ya-l 崧Ӿ<_ޟeXq9xmrk{C8h̼e:a8\Ӷ/aN`\+./_t|;|[d7uY&\X>; cR[Szix5` O5u]99޶_.O3 ^ӆe]5vM_i ,[[Ðפvj_px^O6iz~u~\;^ϧ6wty >iZ<\dɇvJSy\gDM͆?ww8`Mۮt7_[sORnczf5 0 rm뫗oGea>0˾0邻y{F7 |>X1^:|yf' ed߭'s|xfU_zN v엾c`#-po~6)=9h!_y5}=2w+ 'AMWScan\\Detection\\ArithmeticEvaluator', 'AMWScan\\CodeMatch' => 'AMWScan\\Detection\\CodeMatch', 'AMWScan\\Deobfuscator' => 'AMWScan\\Detection\\Deobfuscator', 'AMWScan\\Exploits' => 'AMWScan\\Detection\\Exploits', 'AMWScan\\Functions' => 'AMWScan\\Detection\\Functions', 'AMWScan\\Signatures' => 'AMWScan\\Detection\\Signatures', 'AMWScan\\Actions' => 'AMWScan\\Remediation\\Actions', 'AMWScan\\Abstracts\\SingletonAbstract' => 'AMWScan\\Filesystem\\Cache', 'AMWScan\\Cache' => 'AMWScan\\Filesystem\\Cache', 'AMWScan\\Path' => 'AMWScan\\Filesystem\\Path', 'AMWScan\\Definitions\\DefinitionPathResolver' => 'AMWScan\\Filesystem\\ResourceLocator', 'AMWScan\\Support\\ResourcePathResolver' => 'AMWScan\\Filesystem\\ResourceLocator', 'AMWScan\\Archive\\ArchiveScanner' => 'AMWScan\\Scan\\ArchiveScanner', 'AMWScan\\Checkpoint\\CheckpointStore' => 'AMWScan\\Scan\\CheckpointStore', 'AMWScan\\Scanner' => 'AMWScan\\Scan\\Scanner', 'AMWScan\\Observables\\DomainExtractor' => 'AMWScan\\Reputation\\DomainExtractor', 'AMWScan\\Templates\\Report' => 'AMWScan\\Reporting\\Report', 'AMWScan\\Templates\\Table' => 'AMWScan\\Reporting\\Table', 'AMWScan\\Modules' => 'AMWScan\\Platform\\PlatformRegistry', 'AMWScan\\Interfaces\\VerifierInterface' => 'AMWScan\\Platform\\VerifierInterface', 'AMWScan\\Modules\\CakePHP\\Verifier' => 'AMWScan\\Platform\\CakePHP\\Verifier', 'AMWScan\\Modules\\CodeIgniter\\Verifier' => 'AMWScan\\Platform\\CodeIgniter\\Verifier', 'AMWScan\\Modules\\Composer\\Inventory' => 'AMWScan\\Platform\\Composer\\Inventory', 'AMWScan\\Modules\\Composer\\Verifier' => 'AMWScan\\Platform\\Composer\\Verifier', 'AMWScan\\Modules\\Drupal\\Verifier' => 'AMWScan\\Platform\\Drupal\\Verifier', 'AMWScan\\Modules\\Git\\RepositoryVerifier' => 'AMWScan\\Platform\\RepositoryVerifier', 'AMWScan\\Modules\\Joomla\\Verifier' => 'AMWScan\\Platform\\Joomla\\Verifier', 'AMWScan\\Modules\\Laravel\\Verifier' => 'AMWScan\\Platform\\Laravel\\Verifier', 'AMWScan\\Modules\\Magento\\Verifier' => 'AMWScan\\Platform\\Magento\\Verifier', 'AMWScan\\Modules\\PrestaShop\\Verifier' => 'AMWScan\\Platform\\PrestaShop\\Verifier', 'AMWScan\\Modules\\Symfony\\Verifier' => 'AMWScan\\Platform\\Symfony\\Verifier', 'AMWScan\\Modules\\TYPO3\\Verifier' => 'AMWScan\\Platform\\TYPO3\\Verifier', 'AMWScan\\Modules\\WooCommerce\\Verifier' => 'AMWScan\\Platform\\WooCommerce\\Verifier', 'AMWScan\\Modules\\Yii\\Verifier' => 'AMWScan\\Platform\\Yii\\Verifier', 'AMWScan\\Modules\\Wordpress\\ContentInventory' => 'AMWScan\\Platform\\WordPress\\ContentInventory', 'AMWScan\\Modules\\Wordpress\\Database' => 'AMWScan\\Platform\\WordPress\\Database', 'AMWScan\\Modules\\Wordpress\\Inventory' => 'AMWScan\\Platform\\WordPress\\Inventory', 'AMWScan\\Modules\\Wordpress\\Verifier' => 'AMWScan\\Platform\\WordPress\\Verifier', ] as $legacy => $target) { class_alias($target, $legacy); } run(array_slice($argv, 1)); if ($result !== null) { exit($result); } } catch (\Throwable $error) { fwrite(STDERR, 'Definition command failed: ' . $error->getMessage() . PHP_EOL); exit(2); } } exit((new \AMWScan\Console\Application())->run());~ Gj 2JѬvXy&m;GBMB